CVE-2026-37007: Path Traversal

Q: What does an attacker need to exploit this issue?

The attacker needs the ability to supply a malicious filename argument to FileWriterTool. Path traversal sequences in that argument can be used to achieve code execution.

Q: Which releases are affected?

FileWriterTool in crewai-tools versions up to and including 1.10.2rc1 are affected.

Q: Who is realistically exposed?

Deployments that expose FileWriterTool to remote, attacker-controlled filename input are exposed. The provided information does not establish whether any default configuration makes that input remotely accessible.

Published Aug 27, 2026

Updated

A vulnerability in FileWriterTool in crewai-tools <= 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the filename argument.

Affected Software

1 affected component

crewai-tools/FileWriterTool<=1.10.2rc1

Event History

Aug 27, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·08:17 PM

Description

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker needs the ability to supply a malicious filename argument to FileWriterTool. Path traversal sequences in that argument can be used to achieve code execution.

Which releases are affected?

FileWriterTool in crewai-tools versions up to and including 1.10.2rc1 are affected.

Who is realistically exposed?

Deployments that expose FileWriterTool to remote, attacker-controlled filename input are exposed. The provided information does not establish whether any default configuration makes that input remotely accessible.