← Back to search

CVE-2026-55747

6.8 MEDIUMpublic exploit available

Published 2026-08-05 · Updated 2026-08-10

AI risk analysis

Summary
The flaw involves improper file path handling in a cookbook example, allowing for potential directory traversal attacks if copied into production code.
Exploitability
Exploitation requires copying the flawed pattern into production and specific knowledge of the target directory structure; relatively difficult without these conditions.
Blast radius
If exploited, could lead to data exposure or manipulation in affected applications using similar file access patterns.
Prioritized remediation
Implement thorough path canonicalization and containment checks before accessing files in any copied code.
path-traversalfile-accesssecurity-best-practices

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

The pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow implements a helper as a thin os.path.join(workdir, p) wrapper with no canonicalization or containment check, used unguarded by the ReadFile, ListFiles, PatchRead, and PatchApply file-access tools. Severity reflects that this affects an illustrative cookbook example rather than a core library API; applications that copy this pattern into production are affected.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Weaknesses

CWE-22

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.