SWE-agent’s trajectory inspector implements an HTTP server that serves files from a trajectory directory by concatenating request paths without filtering parent directory references. The server accepts any HTTP request on all interfaces, uses wildcard CORS headers, and does not require authentication. As a result, an attacker can send a path traversal sequence in the request URL to read arbitrary JSON files from the filesystem. Because the server parses only trajectory‑formatted JSON, the disclosure is limited to files that match this format, yet such files can contain repository contents, command output, and sensitive credentials. The vulnerability enables confidential data exposure without needing credentials.

The affected product is SWE‑agent, specifically the trajectory inspector component confirmed in version 1.1.0. No other affected versions are listed in the available data, but the vulnerability existed at that release. Systems running SWE‑agent that expose the /trajectory/ endpoint over the network, especially those with unrestricted access or allowing external web pages to trigger requests via CORS, are impacted.

The CVSS score of 8.7 indicates a high severity, and although an EPSS score is unavailable, the attack vector is straightforward: an unauthenticated client can request a crafted URL, bypassing path restrictions. The vulnerability is not listed in the CISA KEV catalog, but the lack of authentication and wildcard CORS greatly lower the barrier to exploitation. Attackers could read sensitive JSON files with repository or credential data by targeting the server’s open HTTP endpoint.