Omnigent 0.3.0, before 0.14.0, has a path traversal flaw that lets an authenticated user manipulate the sub‑agent’s os_env.cwd parameter when uploading a bundle. By setting this value to an absolute or parent‑traversing directory, the attacker can bypass the root‑only validation enforced in bundles.py and gain the ability to read and write arbitrary host files as the runner user. This flaw enables a privilege escalation that could lead to remote code execution on the host system.

The vulnerability affects Omnigent AI’s Omnigent software, specifically all releases from 0.3.0 up to, but not including, 0.14.0. In these versions the resolution of workspace paths does not properly filter potentially dangerous directory components used by sub‑agents.

The CVSS score of 7.7 indicates a high severity, and the EPSS score is not available, so the current exploitation probability is undefined. The vulnerability is not listed in the CISA KEV catalog. Attackers would first need authenticated access to upload a bundle; the flaw then permits traversal to host file system paths outside the intended workspace, potentially allowing read or write of sensitive files and execution of malicious code as the runner user. Because the flaw bypasses a root‑only check, the impact may extend to system‑wide compromise if the runner user has elevated privileges.