CVE-2026-39981: 
Python vulnerability analysis and mitigation

CVE-2026-39981 is a path traversal vulnerability in AGiXT, a dynamic AI Agent Automation Platform, affecting all versions up to and including 1.9.1. The flaw resides in the safe_join() function within the essential_abilities extension, which fails to validate that resolved file paths remain within the designated agent workspace. An authenticated attacker with only a valid API key can exploit directory traversal sequences to read, write, or delete arbitrary files on the host server. It was disclosed on April 8, 2026, and carries a CVSS v3.1 base score of 8.8 (High) (Github Advisory, AGiXT Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The vulnerable code path flows from agixt/endpoints/Extension.py:165 (source) through agixt/XT.py:1035 (hop) to the sink at agixt/extensions/essential_abilities.py:436, where the safe_join() function uses only os.path.normpath(os.path.join(self.WORKING_DIRECTORY, *paths.split("/"))) — which does not resolve symlinks or verify the final path remains within the workspace. An attacker sends a crafted API request to /api/agent/<AgentName>/command with a filename argument containing traversal sequences such as ../../etc/passwd, which normpath normalizes without enforcing the workspace boundary. No elevated privileges beyond a valid API key are required (AGiXT Advisory, Github Advisory).

Successful exploitation allows an authenticated attacker to read sensitive files (e.g., /etc/passwd, application secrets, API keys), overwrite arbitrary files to achieve persistent code execution, or delete critical files causing denial of service. The combination of read, write, and delete primitives means an attacker could escalate from initial file access to full server compromise — for example, by overwriting application configuration or injecting malicious code into server-side scripts. All confidentiality, integrity, and availability dimensions are rated High (AGiXT Advisory).

A public proof-of-concept (PoC) exploit is available in the official security advisory, consisting of runnable Python code that demonstrates reading /etc/passwd via the path traversal. The EPSS score is approximately 0.051% (16th percentile), indicating a currently low but non-negligible probability of exploitation in the wild. As of the time of disclosure, there is no evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA KEV catalog. No threat actor attribution has been reported (Github Advisory, AGiXT Advisory).

1. Obtain credentials: Acquire a valid AGiXT API key or user credentials — only standard authenticated access is required, with no elevated privileges needed.
2. Identify target: Locate an AGiXT instance running version ≤ 1.9.1, accessible over the network (default port 7437).
3. Craft traversal payload: Construct a POST request to /api/agent/<AgentName>/command with a JSON body specifying a file operation command (e.g., read_file, write_file, or delete_file) and a filename argument containing directory traversal sequences such as ../../etc/passwd.
4. Send the request: Submit the request with the Authorization: Bearer <TOKEN> header. Example PoC:

import requests
BASE = "http://<target>:7437"
TOKEN = "<api_key>"
headers = {"Authorization": f"Bearer {TOKEN}"}
payload = {"command_name": "read_file", "command_args": {"filename": "../../etc/passwd"}}
r = requests.post(f"{BASE}/api/agent/MyAgent/command", json=payload, headers=headers)
print(r.text)

5. Escalate: Use write access to overwrite server-side files (e.g., configuration files, Python scripts) to achieve persistent code execution or further lateral movement on the host (AGiXT Advisory).

• Network: Unusual POST requests to /api/agent/<AgentName>/command endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in the filename parameter; unexpected outbound connections from the AGiXT server process.
• Logs: Application or web server access logs showing POST requests to /api/agent/*/command with filename values containing .. sequences; HTTP 200 responses to such requests indicating successful traversal.
• File System: Unexpected access or modification timestamps on sensitive files outside the AGiXT workspace (e.g., /etc/passwd, /etc/shadow, application config files); new or modified files in server directories not associated with normal AGiXT operation.
• Process: Unusual child processes spawned by the AGiXT Python process following file write operations; unexpected script execution or new cron jobs created under the AGiXT service account (AGiXT Advisory).

Update AGiXT to version 1.9.2 or later, which fixes the vulnerability by replacing os.path.normpath with os.path.realpath to resolve symlinks and adding an explicit boundary check that raises a PermissionError if the resolved path escapes the WORKING_DIRECTORY (AGiXT Commit, AGiXT Release). Until patching is possible, restrict network access to AGiXT instances to trusted users only, audit file system permissions to limit the AGiXT service account's access to sensitive files, and monitor access logs for traversal patterns. No configuration-only workaround fully mitigates the vulnerability without the code fix.

The vulnerability was reported by security researcher YeranG30 and published by the AGiXT maintainer (Josh-XT) via GitHub's security advisory process on April 8, 2026. The advisory was picked up by automated vulnerability tracking services including ENISA's EUVD, VulDB, CVEFeed, and RedHat's CVE tracker shortly after disclosure. No significant independent researcher commentary or major media coverage has been identified beyond standard vulnerability database aggregation.