CVE-2026-105772: Arbitrary file read and write in Google ADK TypeScript (@google/adk) FileArtifactService via path traversal in userId and sessionId

Q: Which deployments are affected?

Only Google ADK TypeScript applications using FileArtifactService and exposing the ADK API server are affected. Applications using the default InMemoryArtifactService are unaffected.

Q: What does an attacker need to exploit this issue?

A remote attacker does not need authentication or user interaction. Exploitation requires the attacker to supply crafted relative or percent-encoded traversal sequences in userId or sessionId parameters.

Q: When can this lead to file writes rather than only file reads?

Writing outside the intended artifact storage root is possible when an agent tool invokes saveArtifact. File reads are limited to files matching the artifact directory layout.

Q: What should teams do if they are affected?

Upgrade @google/adk to version 0.6.0 or later. Until upgraded, avoid exposing an ADK API server configured with the non-default FileArtifactService.

Published Oct 20, 2026

Updated

Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 allows a remote unauthenticated attacker to read files matching the artifact directory layout or write files (when an agent tool invokes saveArtifact) outside the intended artifact storage root via crafted relative or percent-encoded path traversal sequences (such as ../ or ..%2F) in the userId or sessionId parameters when the ADK API server is exposed with the non-default FileArtifactService enabled. Applications using the default InMemoryArtifactService are unaffected. Upgrade to @google/adk version 0.6.0 or later.

Affected Software

1 affected component

npm/@google/adk>=0.4.0<0.6.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade @google/adk to a version that resolves this vulnerability.
Fixed in 0.6.0

Event History

Oct 20, 2026

CVE Published

via MITRE·05:50 PM

Data Sourced

via MITRE·05:50 PM

DescriptionWeakness

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Only Google ADK TypeScript applications using FileArtifactService and exposing the ADK API server are affected. Applications using the default InMemoryArtifactService are unaffected.

What does an attacker need to exploit this issue?

A remote attacker does not need authentication or user interaction. Exploitation requires the attacker to supply crafted relative or percent-encoded traversal sequences in userId or sessionId parameters.

When can this lead to file writes rather than only file reads?

Writing outside the intended artifact storage root is possible when an agent tool invokes saveArtifact. File reads are limited to files matching the artifact directory layout.

What should teams do if they are affected?

Upgrade @google/adk to version 0.6.0 or later. Until upgraded, avoid exposing an ADK API server configured with the non-default FileArtifactService.

CVE-2026-105772: Arbitrary file read and write in Google ADK TypeScript (@google/adk) FileArtifactService via path traversal in userId and sessionId

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

When can this lead to file writes rather than only file reads?

What should teams do if they are affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

When can this lead to file writes rather than only file reads?

What should teams do if they are affected?