GHSA-RM43-82J9-R4MJ: Path Traversal (Arbitrary File Read) in atomic-agents-stack Dashboard

Vulnerability ID: GHSA-RM43-82J9-R4MJ
CVSS Score: 8.2
Published: 2026-08-13

A path traversal vulnerability in the optional dashboard server of atomic-agents-stack before version 1.1.0 allows unauthenticated remote attackers to read arbitrary files from the host filesystem.

TL;DR

Unauthenticated remote path traversal in atomic-agents-stack dashboard allows arbitrary file read.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-22
• Attack Vector: Network
• CVSS v4.0: 8.2 (High)
• EPSS Score: Not Applicable
• Impact: Arbitrary File Read
• Exploit Status: Proof of Concept (PoC)
• KEV Status: Not Listed

Affected Systems

• atomic-agents-stack
• atomic-agents-stack: <= 1.0.0 (Fixed in: 1.1.0)

Code Analysis

Commit: ec474f4

Secure file serving by routing paths through safe_resolve_under validation checks.

Exploit Details

• GitHub Fix Commit Test Suite: Comprehensive integration security test suite (test_dashboard_serve_security.py) verifying regression resistance.

Mitigation Strategies

• Upgrade the atomic-agents-stack library to version 1.1.0 or newer.
• Bind the dashboard listener interface to loopback (127.0.0.1) instead of all interfaces.
• Execute the application process using a dedicated low-privilege user account.

Remediation Steps:

1. Run 'pip install --upgrade atomic-agents-stack>=1.1.0' to update the package.
2. Verify that the --host parameter is not set to 0.0.0.0 when starting the dashboard.
3. Audit application environments for exposure of sensitive environment variables or keys.

References

• GHSA-RM43-82J9-R4MJ Advisory
• Vendor Security Advisory
• Fix Commit

Read the full report for GHSA-RM43-82J9-R4MJ on our website for more details including interactive diagrams and full exploit analysis.