CVE-2026-54520: AI Agent Automation: Workflow file step path traversal allows read and write outside the expected directory
AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, the executeStep file-step implementation in backend/src/agents/executor.js passes the user-controlled step.path value through path.resolve with process.cwd() and then uses the resulting path for read or write operations without checking that it remains in an approved workflow directory. An authenticated user who can create or modify workflow file steps can supply traversal segments to escape the intended workspace and read sensitive files or write and overwrite files accessible to the backend process, including application-adjacent files when process permissions allow. This issue is fixed in version 0.9.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AI Agent Automationto a version that resolves this vulnerability.Fixed in 0.9.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who can create or modify workflow file steps can exploit it. Exploitation does not require user interaction and can be performed remotely.
What access could an attacker gain through a vulnerable file step?
An attacker can use traversal segments in the step path to escape the intended workspace. They may read sensitive files or write and overwrite files that the backend process is permitted to access, including application-adjacent files.
Which versions should be remediated?
Versions prior to 0.9.1 are affected. Upgrade to version 0.9.1, which fixes the issue.
What should be restricted if an immediate upgrade is not possible?
Restrict the ability to create or modify workflow file steps to only fully trusted users. Limit the backend process permissions so it cannot read or write sensitive or application-adjacent files unnecessarily.