CVE-2026-39981

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-39981
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39981.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-39981
Aliases
Published
2026-04-09T17:01:27.069Z
Modified
2026-07-15T01:48:51.850165122Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
AGiXT has a Path Traversal in safe_join()
Details

AGiXT is a dynamic AI Agent Automation Platform. Prior to 1.9.2, the safejoin() function in the essentialabilities extension fails to validate that resolved file paths remain within the designated agent workspace. An authenticated attacker can use directory traversal sequences to read, write, or delete arbitrary files on the server hosting the AGiXT instance. This vulnerability is fixed in 1.9.2.

Database specific 
{
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39981.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/josh-xt/agixt

Affected ranges

Type
GIT
Repo
https://github.com/josh-xt/agixt
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e9d22e2c85cdcc2a97daf05b502660fa53c12640
Fixed
2079ea5a88fa671a921bf0b5eba887a5a1b73d5f
Database specific 
{
    "cpe": "cpe:2.3:a:agixt:agixt:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.9.2"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.8.0
v1.8.1
v1.8.2
v1.9.0
v1.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39981.json"