{"uuid": "53b61593-162d-40a1-9c6d-e20eb5e918f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-RM43-82J9-R4MJ", "type": "seen", "source": "https://gist.github.com/alon710/d62f1422f9dac4c6a1fc5e9b8b380828", "content": "# GHSA-RM43-82J9-R4MJ: GHSA-RM43-82J9-R4MJ: Path Traversal (Arbitrary File Read) in atomic-agents-stack Dashboard\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-08-13\n> **Full Report:** https://cvereports.com/reports/GHSA-RM43-82J9-R4MJ\n\n## Summary\nA path traversal vulnerability in the optional dashboard server of atomic-agents-stack before version 1.1.0 allows unauthenticated remote attackers to read arbitrary files from the host filesystem.\n\n## TL;DR\nUnauthenticated remote path traversal in atomic-agents-stack dashboard allows arbitrary file read.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **CVSS v4.0**: 8.2 (High)\n- **EPSS Score**: Not Applicable\n- **Impact**: Arbitrary File Read\n- **Exploit Status**: Proof of Concept (PoC)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- atomic-agents-stack\n- **atomic-agents-stack**: <= 1.0.0 (Fixed in: `1.1.0`)\n\n## Mitigation\n\n- Upgrade the atomic-agents-stack library to version 1.1.0 or newer.\n- Bind the dashboard listener interface to loopback (127.0.0.1) instead of all interfaces.\n- Execute the application process using a dedicated low-privilege user account.\n\n**Remediation Steps:**\n1. Run 'pip install --upgrade atomic-agents-stack>=1.1.0' to update the package.\n2. Verify that the --host parameter is not set to 0.0.0.0 when starting the dashboard.\n3. Audit application environments for exposure of sensitive environment variables or keys.\n\n## References\n\n- [GHSA-RM43-82J9-R4MJ Advisory](https://github.com/advisories/GHSA-RM43-82J9-R4MJ)\n- [Vendor Security Advisory](https://github.com/dep0we/atomic-agents-stack/security/advisories/GHSA-rm43-82j9-r4mj)\n- [Fix Commit](https://github.com/dep0we/atomic-agents-stack/commit/ec474f458122c5c0ca718d0df3078c8080338b2c)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-RM43-82J9-R4MJ) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-13T15:33:17.892734Z"}