The vulnerability in FileArtifactService permits a caller running in one application to list, read, overwrite, or delete artifacts belonging to another application when both share a FileArtifactService root directory and use the same user_id (and session_id for session‑scoped artifacts). This results in unauthorized disclosure of data, potential modification, and deletion across application boundaries, violating confidentiality and integrity and reflecting CWE‑668.

All installations of Google Agent Development Kit (ADK) for Python with versions 1.19.0 through 1.39.0 and 2.0.0a1 through 2.6.0 are affected. Upgrades to 1.39.1 (for 1.x) or 2.7.0 (for 2.x) and later remove the vulnerability.

The CVSS score of 5.3 indicates moderate overall severity, and the lack of an available EPSS score means the current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog, but because the attacker only needs to run code that uses ADK in an environment where another application’s artifacts are stored under the same root and user identity, the potential attack vector is likely local or within a shared deployment such as a multi‑tenant environment. If successfully exploited, an attacker could compromise data belonging to other applications on the same host.