CVE-2026-85685
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
AgentScope through 2.0.7.post1 contains a path traversal vulnerability in LocalWorkspace.add_skill that copies arbitrary server directories into the agent workspace via an unconfined source path parameter. Attackers can supply any directory path in the skill_path request parameter to copy files into the skills directory, making them accessible through the workspace skill listing.
Risk Assessment
The risk includes unauthorized access to server files and potential disclosure of sensitive data in the agent workspace.
Recommendation
Restrict the skill_path parameter to allowed directories and apply path validation to prevent copying files from outside permitted locations.
Other vulnerabilities in AgentScope
Original NVD description (English source)
AgentScope through 2.0.7.post1 contains a path traversal vulnerability in LocalWorkspace.add_skill that copies arbitrary server directories into the agent workspace via an unconfined source path parameter. Attackers can supply any directory path in the skill_path request parameter to copy files into the skills directory, making them accessible through the workspace skill listing.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS