CVE-2026-76832: Agno PythonTools Path Traversal via joinpath file_name argument
Agno's PythonTools in libs/agno/agno/tools/python.py contains a path traversal vulnerability that allows attackers to read, write, or execute arbitrary files by supplying parent-directory traversal sequences in the filename argument passed to readfile, savetofile, or runpythonfile tool actions. Attackers can inject traversal sequences such as '../../../../../../etc/passwd' through direct tool invocation or via prompt injection embedded in agent-processed content to escape the intended basedir boundary and achieve arbitrary file read, arbitrary file write, or arbitrary Python code execution within the process user's authority.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Agno PythonTools are exposed when an attacker can influence the file_name argument for the read_file, save_to_file, or run_python_file actions. This can occur through direct tool invocation or prompt injection in content processed by an agent.
What access does an attacker need to exploit it?
The attacker does not need prior privileges, but user interaction is required according to the supplied severity vector. They need a way to cause a PythonTools action to receive a file_name containing parent-directory traversal sequences.
What can an attacker access after successful exploitation?
The attacker can escape the intended base_dir and read or write files accessible to the process user. The run_python_file action can also enable execution of arbitrary Python code with that process user's authority.
How can I identify potentially affected usage?
Review uses of libs/agno/agno/tools/python.py and determine whether PythonTools exposes read_file, save_to_file, or run_python_file to untrusted requests or agent-processed content. Inputs containing sequences such as ../../ that are passed as file_name indicate attempted traversal.