CVE-2026-47118: Agent Zero < 1.15 Path Traversal File Read via image_get API

Synopsis

A path traversal vulnerability in Agent Zero before version 1.15 allows unauthenticated attackers to read arbitrary files through the image_get API endpoint. The endpoint enforces only a file-extension allowlist while path containment checks are explicitly disabled, meaning any file readable by the process and ending with an image extension can be retrieved directly over the network. Successful exploitation gives an attacker read access to files outside the agent workspace, including files in user home directories and mounted volumes. A patched-image rebuild at version 1.15 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable image_get endpoint is exposed over the network, so an attacker must be able to reach the service via HTTP to exploit it.

• AuthenticationNot required

  No credentials or session token are needed; the endpoint accepts unauthenticated requests.

• Victim interactionRequired

  The CVSS v4.0 vector specifies UI:P, meaning some form of passive user interaction (such as a user accessing the application in a context that triggers the vulnerable request) is part of the attack scenario.

• Attack complexityDetail

  Attack complexity is low: the exploit requires only a crafted path string and no race conditions, memory layout assumptions, or other environmental factors to succeed reliably.

Blast Radius

• An attacker reads arbitrary files accessible to the agent-zero process, including configuration files, secrets, and API keys stored on the host filesystem.
• Files in user home directories, such as SSH private keys or shell history, are readable if the process has access to them.
• Contents of mounted volumes, including secrets injected at container runtime, are exposed.
• Symlink-based escapes extend the readable scope beyond directories that would otherwise be reachable through simple path traversal alone.