CVE-2026-51851

Full vulnerability record from the local CVENow database.

Description

modelscope agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_text_file. The save_text_file method accepts user-controlled file paths without normalization or validation, allowing path traversal attacks.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-10-29 18:17:32.153000

Last modified

2026-10-29 18:17:32.153000

View original CVE JSON

{
  "id": "CVE-2026-51851",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-29T18:17:32.153",
  "lastModified": "2026-10-29T18:17:32.153",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "modelscope agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_text_file. The save_text_file method accepts user-controlled file paths without normalization or validation, allowing path traversal attacks."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://gist.github.com/Ro1ME/a1bbf47465175e279a72121cd0df298b",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/agent0ai/agent-zero/issues/1541",
      "source": "[email protected]"
    }
  ]
}