CVE-2026-51851: Path Traversal

Published Oct 29, 2026

Updated

modelscope agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/filebrowser.py:FileBrowser.savetextfile. The savetextfile method accepts user-controlled file paths without normalization or validation, allowing path traversal attacks.

Event History

Oct 29, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·06:17 PM

Description

Frequently Asked Questions

Which releases should be considered affected?

The reported affected releases are modelscope agent-zero 1.7, 1.8, 1.9, and 1.10.

What does an attacker need to exploit this issue?

An attacker needs a way to provide a file path to the FileBrowser.save_text_file method. The reported issue is that this method accepts user-controlled paths without normalization or validation.

CVE-2026-51851: Path Traversal

Event History

Frequently Asked Questions

Which releases should be considered affected?

What does an attacker need to exploit this issue?

Company

Resources

Contact

Frequently Asked Questions

Which releases should be considered affected?

What does an attacker need to exploit this issue?