---
id: CVE-2026-81030
title: >-
  Mage AI does not confine the paths accepted by its browser-items API to the
  project directory
summary: >-
  Mage AI does not confine the paths accepted by its browser-items API to the
  project directory. BrowserItemResource in
  mage_ai/api/resources/BrowserItemResource.py passes a caller-supplied path to
  the filesystem read and write helpers wit…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-22
published: '2026-08-26'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:43:32.537'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-81030'
references:
  - url: 'https://github.com/mage-ai/mage-ai'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/mage-ai/mage-ai/blob/0.9.79/mage_ai/api/resources/BrowserItemResource.py
    label: disclosure@vulncheck.com
  - url: 'https://github.com/mage-ai/mage-ai/issues/6134'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/mage-ai-through-0.9.79-arbitrary-file-read-via-unvalidated-path-in-browser-items-endpoint
    label: disclosure@vulncheck.com
  - url: 'https://github.com/mage-ai/mage-ai/issues/6134'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00574
epssPercentile: 0.44983
ingestedAt: '2026-09-24T20:51:40.232Z'
---

## Overview

Mage AI does not confine the paths accepted by its browser-items API to the project directory. BrowserItemResource in mage_ai/api/resources/BrowserItemResource.py passes a caller-supplied path to the filesystem read and write helpers without calling the containment helper that the sibling FileContentResource and FileResource classes both use, so the resource contains no such call while those two contain several. A user holding the Viewer role, which grants read access within the project and nothing outside it, can therefore read any file the server process can read by supplying an absolute path. The permission model that would otherwise separate roles is not consulted for this route in the default configuration, because the setting that enables it defaults to false. Callers holding the Editor role additionally write through the same unconfined path, though that role is already able to execute code by design, so the boundary crossed by this flaw is the read available to the Viewer role.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.