CVE-2026-47118 Agent Zero < 1.15 Path Traversal File Read via image_get API

🗓️ 27 May 2026 14:22:29Reported by GoogleType

osv🔗 osv.dev👁 2 Views

Unauthenticated path traversal in Agent Zero before version 1.15 allows reading arbitrary files via image_get due to disabled path containment and an extension allowlist.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2026-47118	27 May 202614:22	–	attackerkb
CNNVD	Agent Zero 路径遍历漏洞	27 May 202600:00	–	cnnvd
CVE	CVE-2026-47118	27 May 202614:22	–	cve
Cvelist	CVE-2026-47118 Agent Zero < 1.15 Path Traversal File Read via image_get API	27 May 202614:22	–	cvelist
EUVD	EUVD-2026-32522	27 May 202614:22	–	euvd
NVD	CVE-2026-47118	27 May 202615:16	–	nvd
Positive Technologies	PT-2026-44005	27 May 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-47118	28 May 202620:12	–	redhatcve
Vulnrichment	CVE-2026-47118 Agent Zero < 1.15 Path Traversal File Read via image_get API	27 May 202614:22	–	vulnrichment

Source	Link
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47118.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-47118
vulncheck	www.vulncheck.com/advisories/agent-zero-path-traversal-file-read-via-image-get-api
github	www.github.com/agent0ai/agent-zero/issues/1609
github	www.github.com/3clyp50/agent-zero/commit/1f2d5122265282d6b98bc36ee8f9d0f8ab76db9e
github	www.github.com/3clyp50/agent-zero

08 Jul 2026 08:14Current

6.1Medium risk

Vulners AI Score6.1

CVSS 47.1

EPSS0.00375