CVE-2026-29870: Agentic-Context-Engine Path Traversal

CVE-2026-29870 Overview

A directory traversal vulnerability exists in the agentic-context-engine project versions up to 0.7.1 that allows arbitrary file writes via the checkpoint_dir parameter in OfflineACE.run. The save_to_file method in ace/skillbook.py fails to normalize or validate filesystem paths, allowing traversal sequences to escape the intended checkpoint directory. This vulnerability allows attackers to overwrite arbitrary files accessible to the application process, potentially leading to application corruption, privilege escalation, or code execution depending on the deployment context.

Critical Impact

Attackers can exploit this directory traversal flaw to write arbitrary files outside the intended checkpoint directory, potentially overwriting critical application files, configuration files, or even executable code, leading to full system compromise.

Affected Products

• agentic-context-engine versions up to and including 0.7.1

Discovery Timeline

• 2026-03-31 - CVE CVE-2026-29870 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-29870

Vulnerability Analysis

This directory traversal vulnerability (CWE-22) affects the agentic-context-engine project, specifically within the checkpoint functionality. The root issue lies in how the application handles user-supplied file paths without proper validation or sanitization. When an attacker provides malicious input containing path traversal sequences (such as ../) to the checkpoint_dir parameter, the application fails to normalize these paths before performing file write operations.

The vulnerability is exploitable over the network and requires low privileges to exploit. While the attack complexity is low, the impact is significant: attackers can achieve high integrity impact by overwriting arbitrary files, with additional risks to confidentiality and availability of the affected system.

Root Cause

The save_to_file method in ace/skillbook.py lacks proper path validation and normalization. The function accepts user-controlled input for file paths without checking for directory traversal sequences or ensuring the resulting path remains within the intended checkpoint directory. This allows an attacker to craft input containing ../ sequences that escape the intended directory boundary and write files to arbitrary locations on the filesystem.

Attack Vector

The attack is conducted over the network (AV:N) with low attack complexity (AC:L). An authenticated attacker with low privileges can exploit this vulnerability by manipulating the checkpoint_dir parameter passed to OfflineACE.run. By injecting path traversal sequences such as ../../etc/ or similar patterns, the attacker can direct file write operations to sensitive system locations.

Depending on the deployment context and the privileges under which the application runs, successful exploitation could result in:

• Application Corruption: Overwriting application binaries or configuration files
• Privilege Escalation: Writing to privileged system locations when running with elevated permissions
• Code Execution: Overwriting executable files, scripts, or configuration files that are subsequently executed

For detailed technical information about this vulnerability, refer to the GitHub Security Research.

Detection Methods for CVE-2026-29870

Indicators of Compromise

• File system audit logs showing write operations to unexpected directories outside the checkpoint path
• Application logs containing path traversal sequences (../, ..\\) in checkpoint-related parameters
• Unexpected modification of system files or configuration files in sensitive directories
• New or modified files appearing in directories outside the normal application scope

Detection Strategies

• Monitor application input for path traversal patterns such as ../, ..\\, %2e%2e/, and URL-encoded variants targeting the checkpoint_dir parameter
• Implement file integrity monitoring (FIM) on critical system directories to detect unauthorized modifications
• Review application logs for anomalous file write operations outside expected checkpoint directories
• Deploy web application firewalls (WAF) with rules to detect and block path traversal attack patterns

Monitoring Recommendations

• Enable detailed audit logging for file system operations in directories accessible by the agentic-context-engine application
• Configure alerts for file write operations that target system directories such as /etc/, /usr/, or application binary directories
• Monitor for process executions or service restarts following unexpected file modifications
• Implement real-time log analysis to correlate checkpoint operations with suspicious file system activity

How to Mitigate CVE-2026-29870

Immediate Actions Required

• Restrict the application's filesystem permissions to limit write access to only the intended checkpoint directories
• Implement network-level access controls to limit who can interact with the affected application functionality
• Review and audit all existing checkpoint files to ensure no unauthorized modifications have occurred
• Consider disabling the checkpoint functionality temporarily until a patch is applied

Patch Information

No official patch information is currently available from the vendor. Organizations should monitor the GitHub Security Research for updates and patch availability. Consider upgrading to a version newer than 0.7.1 when available.

Workarounds

• Implement input validation at the application layer to reject any paths containing traversal sequences before they reach the vulnerable save_to_file method
• Configure a sandboxed environment or container with restricted filesystem access for running the agentic-context-engine application
• Use operating system-level controls (such as chroot jails or SELinux/AppArmor policies) to confine file write operations to specific directories
• Deploy a reverse proxy or API gateway that sanitizes and validates the checkpoint_dir parameter before forwarding requests

# Example: Restrict filesystem access using AppArmor profile
# Create profile at /etc/apparmor.d/agentic-context-engine
# Deny write access to sensitive directories while allowing checkpoint_dir
/path/to/checkpoint_dir/** rw,
deny /etc/** w,
deny /usr/** w,
deny /bin/** w,
deny /sbin/** w,