Description
AGiXT is a dynamic AI Agent Automation Platform. Prior to 1.9.2, the safe_join() function in the essential_abilities extension fails to validate that resolved file paths remain within the designated agent workspace. An authenticated attacker can use directory traversal sequences to read, write, or delete arbitrary files on the server hosting the AGiXT instance. This vulnerability is fixed in 1.9.2.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Josh-XT | AGiXT | affected |
|
No data.
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-5gfj-64gh-mgmw | AGiXT Vulnerable to Path Traversal in safe_join() |
References
History
Thu, 09 Apr 2026 17:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | AGiXT is a dynamic AI Agent Automation Platform. Prior to 1.9.2, the safe_join() function in the essential_abilities extension fails to validate that resolved file paths remain within the designated agent workspace. An authenticated attacker can use directory traversal sequences to read, write, or delete arbitrary files on the server hosting the AGiXT instance. This vulnerability is fixed in 1.9.2. | |
| Title | AGiXT has a Path Traversal in safe_join() | |
| Weaknesses | CWE-22 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-04-09T17:01:27.069Z
Reserved: 2026-04-08T00:01:47.628Z
Link: CVE-2026-39981
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-04-09T18:17:02.350
Modified: 2026-04-09T18:17:02.350
Link: CVE-2026-39981
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses