{"id":"GHSA-rm43-82j9-r4mj","title":"atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary file read","summary":"atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary file read","severity":"high","cwe":["CWE-22"],"vendor":"atomic-agents-stack","product":"atomic-agents-stack","ecosystem":"pip","affected":["atomic-agents-stack <= 1.0.0"],"patched":["atomic-agents-stack 1.1.0"],"published":"2026-08-13","updated":"2026-08-13","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-rm43-82j9-r4mj","references":[{"url":"https://github.com/dep0we/atomic-agents-stack/security/advisories/GHSA-rm43-82j9-r4mj"},{"url":"https://github.com/dep0we/atomic-agents-stack/commit/ec474f458122c5c0ca718d0df3078c8080338b2c"},{"url":"https://github.com/advisories/GHSA-rm43-82j9-r4mj"}],"tags":["ghsa","pip"],"ingestedAt":"2026-08-13T15:03:45.902Z","slug":"GHSA-rm43-82j9-r4mj","body":"## Overview\n\nThe optional dashboard HTTP server (`atomic_agents/dashboard/serve.py`) builds filesystem paths directly from the request path and serves them without a containment check. It is the only per-request untrusted-path site in the codebase that does not route through `_io.safe_resolve_under`. Literal `../` segments survive `urlparse` and `Path` joining, so a request can read files outside the intended `agents_root` (including via the static branch).\n\n**Impact:** arbitrary file read. The default bind is loopback, but `--host` is an operator-settable documented flag; binding `0.0.0.0` exposes this to the LAN. Even on loopback it is reachable via DNS-rebinding from a browser or SSRF from a co-located service.\n\n**Affected:** `dashboard/serve.py` (`DashboardHandler.do_GET` / `_serve_file`), all versions through 1.0.0.\n\n**Fix:** route every served path through `_io.safe_resolve_under` against the intended root and return 404 on `PathTraversalError`; reject `..`/separators early; optionally refuse a non-loopback `--host` unless an explicit auth/allow flag is set (matching `serve/_app.py`).\n\n## Affected packages\n\n- `atomic-agents-stack <= 1.0.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `atomic-agents-stack 1.1.0`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}