Path Traversal Vulnerability in zhayujie CowAgent Software

CVE-2026-15331

What is CVE-2026-15331?

A vulnerability was discovered in the zhayujie CowAgent software, specifically within the Skill Installation Handler component. The issue lies in the _add_url/_add_package functions, where improper handling of the argument Name allows for path traversal attacks. This vulnerability can be exploited remotely, potentially giving attackers unauthorized access to sensitive files on the server. Users are strongly advised to upgrade to version 2.1.2 or later to mitigate this risk, as it contains the necessary patches to secure the affected functions.

References