Path traversal and arbitrary directory deletion/overwrite via agent profile import in local-operator

The /v1/agents/import endpoint and AgentRegistry.importagent in local-operator versions before 0.47.5 trust the id field inside agent.yml of an uploaded agent profile archive when constructing the destination directory. A crafted id containing directory traversal sequences makes shutil.rmtree and...

PT-2026-105770

The /v1/agents/import endpoint and AgentRegistry.import agent in local-operator versions before 0.47.5 trust the id field inside agent.yml of an uploaded agent profile archive when constructing the destination directory. A crafted id containing directory traversal sequences makes shutil.rmtree an...