CVE-2026-55747
6.8 MEDIUMpublic exploit availablePublished 2026-08-05 · Updated 2026-08-10
AI risk analysis
- Summary
- The flaw involves improper file path handling in a cookbook example, allowing for potential directory traversal attacks if copied into production code.
- Exploitability
- Exploitation requires copying the flawed pattern into production and specific knowledge of the target directory structure; relatively difficult without these conditions.
- Blast radius
- If exploited, could lead to data exposure or manipulation in affected applications using similar file access patterns.
- Prioritized remediation
- Implement thorough path canonicalization and containment checks before accessing files in any copied code.
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
The pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow implements a helper as a thin os.path.join(workdir, p) wrapper with no canonicalization or containment check, used unguarded by the ReadFile, ListFiles, PatchRead, and PatchApply file-access tools. Severity reflects that this affects an illustrative cookbook example rather than a core library API; applications that copy this pattern into production are affected.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Weaknesses
CWE-22
Public exploit & PoC references
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.