CVE

CVE-2025-55523

3.5

CVSSlow

Exploitable from an adjacent network · low-privilege account sufficient.

Description

An issue in the component /api/download_work_dir_file.py of Agent-Zero v0.8.* allows attackers to execute a directory traversal.

Attack Vector

Adjacent

Privileges Req.

Low

User Interaction

None

Updated Nov 10, 2026View on NVD →

S4E scanner

highProduct Based Web Vulnerabilities~10 seconds

Agent-Zero 0.8.0 - 0.9.4 - Arbitrary File Download

Agent-Zero v0.8.0 - 0.9.4 contains a path traversal caused by improper validation in /api/download_work_dir_file.py, letting attackers access unauthorized files, exploit requires crafted request. References: https://nvd.nist.gov/vuln/detail/CVE-2025-55523 https://github.com/agent0ai/agent-zero/issues/687 Remediation: Update to the latest version of Agent-Zero

url

Scanner page →Run scanner

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →