CVE-2026-91989: atomic-agents-stack before 1.1.0 Path Traversal via dashboard serve.py
atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the dashboard HTTP server that allows remote attackers to read arbitrary files by supplying directory traversal sequences in request paths. Attackers can bypass path containment checks by including '../' segments in requests to the DashboardHandler.doGET endpoint to access files outside the intended agentsroot directory.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
Deployments of atomic-agents-stack before 1.1.0 that expose the dashboard HTTP server to an attacker are affected. Exploitation is remote and requires no privileges or user interaction.
What access can an attacker obtain?
An attacker can read arbitrary files outside the intended agents_root directory by sending request paths containing ../ traversal segments to the DashboardHandler.do_GET endpoint. The reported impact is confidentiality loss; integrity and availability impact are not indicated.
How can I determine whether my instance is affected?
Check whether the installed atomic-agents-stack version is earlier than 1.1.0 and whether its dashboard HTTP server is running. Affected servers may allow requests with ../ segments to resolve files outside agents_root.