Description

A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. This affects the function read of the file metagpt/tools/libs/editor.py. This manipulation causes path traversal. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-08-06T22:16:52.903Z",
  "pubdate": "2026-08-06T22:16:52.903Z",
  "executiveSummary": "An unauthenticated path traversal vulnerability has been identified in FoundationAgents MetaGPT up to version 0.8.2, specifically within the read function of the metagpt/tools/libs/editor.py file. This security flaw permits unauthorized local file system access, potentially allowing malicious actors to read arbitrary files outside the intended directory boundaries. The risk implications include the exposure of sensitive system files, configuration data, or source code depending on the privileges of the executing process. Exploitation requires local access to the system where the affected software is running, and the vulnerability can be triggered via crafted input supplied to the vulnerable read function. The vendor was notified of this disclosure but failed to provide a response or official patch, leaving deployments up to version 0.8.2 exposed to potential exploitation given that the exploit has been publicly disclosed.",
  "technicalDetails": "The vulnerability resides in the read function located within the metagpt/tools/libs/editor.py file of FoundationAgents MetaGPT versions up to 0.8.2. The root cause of the security issue stems from insufficient input sanitization and validation of file path parameters passed to the file reading mechanism. Specifically, the implementation fails to adequately neutralize directory traversal sequences, such as dot-dot-slash (../) patterns, allowing attackers to break out of the designated working directory.\nThe exploitation method relies on supplying a specially crafted file path containing traversal sequences to the vulnerable read function. When the component processes this input, it resolves the path relative to the root or working directory, thereby granting read access to sensitive areas of the underlying file system. Because the attack vector targets a local interface, the attacker must have local execution capabilities or the ability to influence parameters passed to the editor tool library.\nThe attack flow proceeds as follows: First, the adversary identifies an interface or execution context within MetaGPT that invokes the read function in metagpt/tools/libs/editor.py. Second, the adversary crafts a malicious payload incorporating relative path sequences (e.g., ../../../../etc/passwd or similar sensitive system files). Third, the payload is submitted to the vulnerable function without proper bounds checking or canonicalization of the path. Fourth, the application processes the request, opens the targeted file outside the intended sandbox, and returns the contents to the caller.\nFrom a privilege and exposure perspective, the vulnerability requires local access to launch the attack. Network exposure is dependent on how the underlying MetaGPT components expose the editor tools, but the primary flaw is localized to the file processing logic. The post-exploitation impact includes the unauthorized disclosure of confidential data, internal application logic, or system credentials accessible to the user context running the MetaGPT instance."
}