CVE-2026-5998

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A flaw has been found in zhayujie chatgpt-on-wechat CowAgent up to 2.0.4. This affects the function dispatch of the file agent/memory/service.py of the component API Memory Content Endpoint. This manipulation of the argument filename causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used. Upgrading to version 2.0.5 mitigates this issue. Patch name: 174ee0cafc9e8e9d97a23c305418251485b8aa89. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Apr 10, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-599806.3hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation onCVE-2026-599817.1OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versCVE-2026-599827.1OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versCVE-2026-599835.5OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versCVE-2026-599845.5OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versCVE-2026-599855.5OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versCVE-2026-599899.2Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep bCVE-2026-59996.3A vulnerability has been found in JeecgBoot up to 3.9.1. This impacts an unknown function of the component SysAnnouncementController. Such mCVE-2026-599907.5Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depthCVE-2026-599917.5psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite() and PSDImage.numpy() allocatCVE-2026-599925.4Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-CVE-2026-599944.3EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an unauthenticated remote attacker can send an email