---
id: CVE-2026-91989
title: >-
  atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in
  the dashboard HTTP server that allows remote attackers to read arbitrary files
  by supplying directory traversal sequences in request paths
summary: >-
  atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in
  the dashboard HTTP server that allows remote attackers to read arbitrary files
  by supplying directory traversal sequences in request paths. Attackers can
  bypass …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-22
vendor: dep0we
product: atomic-agents-stack
affected:
  - atomic-agents-stack < 1.1.0
patched:
  - atomic-agents-stack 1.1.0
published: '2026-09-15'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:08:55.030'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-91989'
references:
  - url: >-
      https://github.com/dep0we/atomic-agents-stack/security/advisories/GHSA-rm43-82j9-r4mj
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/atomic-agents-stack-before-1.1.0-path-traversal-via-dashboard-serve-py
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/dep0we/atomic-agents-stack/commit/ec474f458122c5c0ca718d0df3078c8080338b2c
  - url: 'https://github.com/dep0we/atomic-agents-stack'
tags:
  - nvd
  - cve.org
  - osv
  - pip
epss: 0.01332
epssPercentile: 0.69887
aliases:
  - GHSA-rm43-82j9-r4mj
ecosystem: pip
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-17T19:15:32.126524Z'
ingestedAt: '2026-09-15T15:39:12.908Z'
---

## Overview

atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the dashboard HTTP server that allows remote attackers to read arbitrary files by supplying directory traversal sequences in request paths. Attackers can bypass path containment checks by including '../' segments in requests to the DashboardHandler.do_GET endpoint to access files outside the intended agents_root directory.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-91989)

Affected packages:

- `atomic-agents-stack < 1.1.0`

Patched in:

- `atomic-agents-stack 1.1.0`

Source: https://osv.dev/vulnerability/GHSA-rm43-82j9-r4mj