CVE-2025-3547: Agent-zero Path Traversal Vulnerability

CVE-2025-3547 Overview

CVE-2025-3547 is a path traversal vulnerability [CWE-22] in frdel Agent-Zero version 0.8.1.2. The flaw resides in the /get_work_dir_files endpoint, where the path argument is not properly sanitized. Attackers can manipulate this parameter to traverse directories outside the intended working directory and read arbitrary files accessible to the application process. The vulnerability is exploitable remotely over the network and requires low privileges. Public disclosure of the exploit technique has already occurred, increasing the risk of opportunistic scanning and exploitation against exposed Agent-Zero instances.

Critical Impact
Remote authenticated attackers can traverse the file system through the path parameter of /get_work_dir_files and disclose sensitive files outside the designated working directory.

Affected Products

frdel Agent-Zero 0.8.1.2
Deployments exposing the /get_work_dir_files endpoint
Environments where Agent-Zero runs with access to sensitive host or workspace files

Discovery Timeline

2025-04-14 - CVE-2025-3547 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3547

Vulnerability Analysis

Agent-Zero exposes a /get_work_dir_files HTTP endpoint intended to list or retrieve files from the agent's designated working directory. The endpoint accepts a path argument that is used to construct a file system path without adequate normalization or containment checks. An attacker supplying traversal sequences such as ../ can escape the intended directory boundary and reference arbitrary locations on the underlying host.

Because the attack is initiated remotely and only requires low privileges, any user or component able to reach the endpoint can request files outside the working directory scope. Exploitation results in unauthorized read access to configuration files, credentials, source code, or other sensitive artifacts stored on the host running the agent.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory, categorized as [CWE-22]. The application concatenates or resolves user-controlled input into a file path without validating that the resolved path remains within the intended working directory. No canonicalization or allow-list check is applied before the file system operation executes.

Attack Vector

Exploitation occurs over the network by issuing an HTTP request to /get_work_dir_files with a crafted path parameter containing directory traversal sequences. The attacker sends relative segments such as ../../etc/passwd or platform-specific equivalents to escape the working directory. No user interaction is required, and the attack complexity is low. Successful requests return the contents of the referenced files to the caller.

The vulnerability is described in the VulDB Entry #304588 and the associated VulDB CTI Report #304588.

Detection Methods for CVE-2025-3547

Indicators of Compromise

HTTP requests to /get_work_dir_files containing ../, ..\, URL-encoded %2e%2e%2f, or double-encoded traversal sequences in the path parameter
Access log entries showing successful responses to /get_work_dir_files with absolute paths or references to system files such as /etc/passwd, /proc/self/environ, or configuration directories
Unexpected outbound reads of secrets, SSH keys, or environment files by the Agent-Zero process

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the path query parameter for traversal patterns and reject decoded ../ sequences
Correlate application logs with file system audit events to identify Agent-Zero accessing files outside its declared working directory
Alert on anomalous file read volume or requests targeting the /get_work_dir_files endpoint from unexpected source addresses

Monitoring Recommendations

Enable verbose HTTP request logging on any reverse proxy fronting Agent-Zero and retain full URL query strings
Monitor process-level file access using Linux audit rules or equivalent controls scoped to the Agent-Zero runtime user
Track EPSS trend data for CVE-2025-3547 to prioritize remediation as exploitation likelihood shifts

How to Mitigate CVE-2025-3547

Immediate Actions Required

Restrict network exposure of the Agent-Zero /get_work_dir_files endpoint to trusted networks and authenticated users only
Place Agent-Zero behind a reverse proxy that filters traversal sequences in the path parameter until an official patch is applied
Audit host file systems for any sensitive data reachable by the Agent-Zero process and relocate or restrict permissions where possible

Patch Information

No vendor advisory or fixed release is listed in the NVD record at the time of publication. Monitor the Agent-Zero project repository for a version newer than 0.8.1.2 that addresses [CWE-22] in the /get_work_dir_files handler. Refer to the VulDB Submission #546220 for ongoing tracking of remediation status.

Workarounds

Run Agent-Zero as an unprivileged user inside a container or chroot with only the intended working directory mounted, limiting the blast radius of traversal
Add reverse proxy or WAF rules that reject any request to /get_work_dir_files whose decoded path value contains .., absolute paths, or null bytes
Disable or firewall the /get_work_dir_files endpoint entirely if the file listing feature is not required for operational use

bash

# Example NGINX rule blocking traversal patterns on the vulnerable endpoint
location /get_work_dir_files {
    if ($args ~* "(\.\./|\.\.\\|%2e%2e|%252e)") {
        return 403;
    }
    proxy_pass http://agent_zero_upstream;
}