Description

Mage AI does not confine the paths accepted by its browser-items API to the project directory. BrowserItemResource in mage_ai/api/resources/BrowserItemResource.py passes a caller-supplied path to the filesystem read and write helpers without calling the containment helper that the sibling FileContentResource and FileResource classes both use, so the resource contains no such call while those two contain several. A user holding the Viewer role, which grants read access within the project and nothing outside it, can therefore read any file the server process can read by supplying an absolute path. The permission model that would otherwise separate roles is not consulted for this route in the default configuration, because the setting that enables it defaults to false. Callers holding the Editor role additionally write through the same unconfined path, though that role is already able to execute code by design, so the boundary crossed by this flaw is the read available to the Viewer role.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-26T16:16:45.710Z",
  "pubdate": "2026-08-26T16:16:45.710Z",
  "executiveSummary": "Mage AI is susceptible to a path traversal vulnerability originating from the BrowserItemResource API, allowing unauthorized file system access.\nThe vulnerability occurs due to insufficient input validation in mage_ai/api/resources/BrowserItemResource.py, which fails to restrict file operations to the project directory.\nBy supplying an absolute path, an attacker with Viewer-level privileges can bypass intended security boundaries to read sensitive files accessible to the server process.\nUsers with Editor-level roles can leverage this flaw to perform arbitrary file writes, potentially leading to remote code execution.\nThe flaw stems from a lack of containment logic that is correctly implemented in other resource classes within the application.\nThe security risk is amplified by the fact that the default configuration does not enforce the permission model for this specific route, making the system vulnerable to unauthorized data exfiltration.\nExploitation requires active authentication with at least Viewer privileges, but does not require additional complex configuration beyond standard access to the API endpoint.",
  "technicalDetails": "The vulnerability resides within mage_ai/api/resources/BrowserItemResource.py in the Mage AI platform. The core issue is an improper implementation of input validation and path sanitization when handling file system requests via the browser-items API.\nUnlike the FileContentResource and FileResource classes, which utilize explicit containment helper functions to restrict operations within the designated project directory, BrowserItemResource passes user-supplied path parameters directly to internal read and write helper methods without validation.\nThe root cause is a lack of path normalization or boundary enforcement against directory traversal sequences or absolute path identifiers. When a request is processed, the application does not verify if the target path is a descendant of the project root.\nFor a Viewer-level user, this represents an escalation of privilege regarding data access. Although the Viewer role is intended to have restricted read access to project-related files only, the ability to supply absolute paths allows the user to traverse the underlying operating system's file structure. An attacker can read any file that the system process running the Mage AI server has permissions to access.\nFor an Editor-level user, the impact is significantly more severe. Because the write helper functions in BrowserItemResource are similarly unconstrained, an Editor can perform arbitrary file writes on the host system. Since the Editor role already possesses the capability to execute code within the application, this vulnerability facilitates persistence or arbitrary system modifications beyond the intended scope of the project container.\nThe vulnerability is further exacerbated by the default configuration of the application, where the specific setting responsible for enforcing the permission model on this route is disabled (set to false). Consequently, the API endpoint bypasses the standard authentication and authorization checks that would otherwise restrict resource access based on the user's defined role.\nThe attack flow involves: 1) Authentication as a user with at least Viewer privileges; 2) Interception or construction of an API request to the BrowserItemResource endpoint; 3) Injection of an absolute file path (e.g., /etc/passwd or system configuration files) into the path parameter; 4) The application processes the request, fails to apply containment filters, and returns the contents of the sensitive file to the requester."
}