Description

AgentScope through 2.0.7.post1 contains a path traversal vulnerability in LocalWorkspace.add_skill that copies arbitrary server directories into the agent workspace via an unconfined source path parameter. Attackers can supply any directory path in the skill_path request parameter to copy files into the skills directory, making them accessible through the workspace skill listing.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-04T15:17:46.220Z",
  "pubdate": "2026-09-04T15:17:46.220Z",
  "executiveSummary": "AgentScope versions through 2.0.7.post1 are susceptible to a path traversal vulnerability located within the LocalWorkspace.add_skill function.\nThe vulnerability arises from insufficient input validation of the 'skill_path' parameter, allowing an attacker to supply arbitrary filesystem paths.\nSuccessful exploitation enables an unauthorized actor to copy sensitive server directories into the agent workspace, thereby exposing them via the workspace skill listing interface.\nThis flaw impacts the confidentiality and integrity of the host system, as sensitive configuration files, source code, or internal data can be moved into publicly or agent-accessible directories.\nNo specific authentication mechanism is documented as a prerequisite for this traversal, suggesting that any entity with access to the vulnerable API endpoint can trigger the file movement.\nThe risk implication is significant, as it provides a mechanism for directory harvesting and unauthorized file exposure within the agent's environment.",
  "technicalDetails": "The vulnerability resides within the 'LocalWorkspace.add_skill' method of the AgentScope framework. The root cause is the lack of sanitization or directory containment logic applied to the 'skill_path' argument before file system operations are performed.\nWhen an agent or user invokes 'add_skill', the system takes the provided 'skill_path' and proceeds to perform a file system copy operation to relocate or integrate the specified directory into the designated workspace.\nBecause the 'skill_path' input is not validated against a secure, confined root directory (chroot) or verified to ensure it resides within the intended application boundaries, an attacker can supply traversal sequences, such as '../', to traverse the host's directory structure.\nThe exploitation flow proceeds as follows: First, an attacker identifies the 'add_skill' API endpoint exposed by the AgentScope framework. Second, the attacker constructs a malicious payload for the 'skill_path' parameter, targeting a sensitive directory on the host server (e.g., '/etc/', '/root/', or application configuration files). Third, the vulnerable function processes the path, effectively copying the contents of the chosen directory into the 'skills' subdirectory of the active workspace. Finally, the attacker interacts with the workspace skill listing interface to retrieve or view the now-exposed sensitive files.\nThis vulnerability is particularly critical because it bypasses standard authorization checks by exploiting the underlying file manipulation logic of the workspace management system. The scope of exposure depends on the privileges of the process running AgentScope; if the framework runs with elevated privileges, the entire filesystem may be reachable through this traversal vector.\nThe post-exploitation impact includes the potential for information disclosure, credential theft via exposed configuration files, and reconnaissance capabilities that facilitate further attacks against the agent infrastructure. Since the files are moved into the 'skills' folder, they are subsequently indexed and exposed by the framework's workspace file-serving logic, making them retrievable through standard network interactions with the agent workspace."
}