Agent‑zero versions 1.7 through 1.10 contain a flaw in the FileBrowser.save_file_b64 routine that writes Base64‑decoded data to disk. The routine accepts a caller‑supplied filename without normalizing or validating the path, creating a directory traversal vector. An attacker able to supply a path such as ../../../../etc/passwd can cause the agent to create or overwrite arbitrary files on any location the process can reach, thus enabling modification of configuration files, program binaries, or system files.

All publicly released agent‑zero releases from 1.7 to 1.10 are affected. The vulnerable code resides in python/helpers/file_browser.py and is exercised whenever the agent processes commands that trigger file writes, a common scenario when the agent operates as a daemon receiving network input or when third‑party plugins interact with it.

The CVSS score of 7.5 reflects a high severity, but the EPSS score of less than 1% indicates a very low historical exploitation likelihood. The vulnerability is not listed in CISA's KEV catalog, suggesting no widespread, confirmed exploitation. However, the absence of path sanitization provides a simple path for attackers. If the agent runs with elevated privileges or can write to critical system locations, an attacker could install malicious binaries or modify configuration files, potentially leading to remote code execution or data exfiltration in environments where the agent accepts untrusted inputs.