---
id: GHSA-rm43-82j9-r4mj
title: >-
  atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary
  file read
summary: >-
  atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary
  file read
severity: high
cwe:
  - CWE-22
vendor: atomic-agents-stack
product: atomic-agents-stack
ecosystem: pip
affected:
  - atomic-agents-stack <= 1.0.0
patched:
  - atomic-agents-stack 1.1.0
published: '2026-08-13'
updated: '2026-08-13'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-rm43-82j9-r4mj'
references:
  - url: >-
      https://github.com/dep0we/atomic-agents-stack/security/advisories/GHSA-rm43-82j9-r4mj
  - url: >-
      https://github.com/dep0we/atomic-agents-stack/commit/ec474f458122c5c0ca718d0df3078c8080338b2c
  - url: 'https://github.com/advisories/GHSA-rm43-82j9-r4mj'
tags:
  - ghsa
  - pip
ingestedAt: '2026-08-13T15:03:45.902Z'
---

## Overview

The optional dashboard HTTP server (`atomic_agents/dashboard/serve.py`) builds filesystem paths directly from the request path and serves them without a containment check. It is the only per-request untrusted-path site in the codebase that does not route through `_io.safe_resolve_under`. Literal `../` segments survive `urlparse` and `Path` joining, so a request can read files outside the intended `agents_root` (including via the static branch).

**Impact:** arbitrary file read. The default bind is loopback, but `--host` is an operator-settable documented flag; binding `0.0.0.0` exposes this to the LAN. Even on loopback it is reachable via DNS-rebinding from a browser or SSRF from a co-located service.

**Affected:** `dashboard/serve.py` (`DashboardHandler.do_GET` / `_serve_file`), all versions through 1.0.0.

**Fix:** route every served path through `_io.safe_resolve_under` against the intended root and return 404 on `PathTraversalError`; reject `..`/separators early; optionally refuse a non-loopback `--host` unless an explicit auth/allow flag is set (matching `serve/_app.py`).

## Affected packages

- `atomic-agents-stack <= 1.0.0`

## Remediation

Upgrade to a patched release:

- `atomic-agents-stack 1.1.0`