CVE-2026-85685

AgentScope through 2.0.7.post1 is affected by a path traversal vulnerability in LocalWorkspace.add_skill . The skill_path request parameter is not confined, allowing an unauthenticated attacker over the network to supply an arbitrary directory path and copy files from any server location into the...