CVE-2026-5998: zhayujie chatgpt-on-wechat CowAgent API Memory Content Endpoint service.py dispatch path traversal
A flaw has been found in zhayujie chatgpt-on-wechat CowAgent up to 2.0.4. This affects the function dispatch of the file agent/memory/service.py of the component API Memory Content Endpoint. This manipulation of the argument filename causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used. Upgrading to version 2.0.5 mitigates this issue. Patch name: 174ee0cafc9e8e9d97a23c305418251485b8aa89. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
zhayujie chatgpt-on-wechat CowAgent (API Memory Content Endpoint, service.py dispatch)to a version that resolves this vulnerability.Fixed in 2.0.5Patch 174ee0cafc9e8e9d97a23c305418251485b8aa89
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5998?
The severity of CVE-2026-5998 is classified as high due to the potential for unauthorized access through path traversal.
How do I fix CVE-2026-5998?
To fix CVE-2026-5998, upgrade zhayujie chatgpt-on-wechat CowAgent to version 2.0.5 or later.
What components are affected by CVE-2026-5998?
CVE-2026-5998 affects the API Memory Content Endpoint in the file agent/memory/service.py.
Can CVE-2026-5998 lead to data exposure?
Yes, CVE-2026-5998 can lead to data exposure through unauthorized access to sensitive files.
Is CVE-2026-5998 exploitable remotely?
Yes, CVE-2026-5998 can be exploited remotely, making it crucial to address promptly.