A path traversal vulnerability has been discovered in the get_abs_path function of the python/helpers/files.py module of agent-zero 0.9.7-10. The faulty handling of path components allows an attacker to craft a request that resolves to a directory outside the intended sandbox, enabling the read or modification of arbitrary files on the host. The flaw provides potential for attackers to gain unauthorized access to sensitive configuration files, credentials, or other data, thereby exposing confidentiality and possibly integrity of the system. Key weakness identified: CWE-22.

The vulnerability affects agent-zero versions 0.9.7-10 from the vendors agent0ai and frdel. No patch or update is listed in the provided data; affected users are urged to verify with the vendors for any fixes or new releases.

The CVSS score for this issue is 5.3, indicating a medium impact potential. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The description explicitly states that the attack can be executed remotely, which allows a remote attacker to construct a malicious request and exploit the path traversal without requiring local privileges. The presence of an publicly released exploit increases the likelihood that adversaries may attempt to use this vulnerability in the wild.