Path Traversal Vulnerability in AgentScope Affects Arbitrary Directory Access

CVE-2026-85685

What is CVE-2026-85685?

AgentScope versions up to 2.0.7.post1 are vulnerable to a path traversal flaw in the LocalWorkspace.add_skill function. This vulnerability allows attackers to exploit the unconfined source path parameter, enabling them to copy arbitrary server directories into the agent workspace. By manipulating the skill_path request parameter, unauthorized users can access sensitive files through the skills directory, which could compromise the security of the application and potentially expose sensitive information.

References