Path Traversal Vulnerability in EverOS by EverMind AI

CVE-2026-58499

What is CVE-2026-58499?

EverOS, a memory runtime for agents developed by EverMind AI, has a vulnerability due to improper validation of the 'sender_id' field in the POST /api/v1/memory/add ingestion endpoint. Prior to version 1.0.1, this flaw allows attackers to manipulate the sender_id to include '../' sequences, enabling them to rewrite or create Markdown (.md) files outside of the designated memory root. This presents a significant risk as an unauthorized user could potentially exploit the vulnerability to insert malicious content into files accessible by the server process. This issue has been addressed in EverOS version 1.0.1, which implements proper validation for the sender_id field.

References