CVE-2026-39981

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

AGiXT is a dynamic AI Agent Automation Platform. Prior to 1.9.2, the safe_join() function in the essential_abilities extension fails to validate that resolved file paths remain within the designated agent workspace. An authenticated attacker can use directory traversal sequences to read, write, or delete arbitrary files on the server hosting the AGiXT instance. This vulnerability is fixed in 1.9.2.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Apr 9, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-399838.6basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\r\n) in file path parame CVE-2026-399845.5Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authorization bypass vulnerab CVE-2026-399856.1LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neur CVE-2026-399879.8marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws CVE-2026-399895.3A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, CVE-2026-39998.8A broken access control may allow an authenticated user to perform a horizontal privilege escalation. The vulnerability only impacts specif CVE-2026-399914.8A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can CVE-2026-399938.7A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can th CVE-2026-399978.9A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability CVE-2026-399988.8Improper Input Validation vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin t CVE-2026-399999.1Authentication Bypass by Spoofing vulnerability in Apache APISIX. The attacker can completely bypass authentication capitalising on certain CVE-2026-400001.8The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files. Third-pa