CVE-2026-5998: ChatGPT-on-WeChat Path Traversal Flaw

CVE-2026-5998 Overview

A path traversal vulnerability has been identified in zhayujie chatgpt-on-wechat CowAgent versions up to 2.0.4. This security flaw affects the dispatch function within the file agent/memory/service.py of the API Memory Content Endpoint component. By manipulating the filename argument, an attacker can traverse directory structures to access files outside the intended directory scope. The vulnerability is remotely exploitable, making it a significant concern for deployments exposed to untrusted networks.

Critical Impact

Remote attackers can exploit this path traversal vulnerability to read arbitrary files from the server by manipulating the filename parameter in the API Memory Content Endpoint, potentially exposing sensitive configuration files, credentials, or application data.

Affected Products

• zhayujie chatgpt-on-wechat CowAgent versions up to 2.0.4
• API Memory Content Endpoint component (agent/memory/service.py)
• Web channel component (channel/web/web_channel.py)

Discovery Timeline

• 2026-04-10 - CVE-2026-5998 published to NVD
• 2026-04-13 - Last updated in NVD database

Technical Details for CVE-2026-5998

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Path Traversal), a common weakness where user-controlled input is used to construct file paths without adequate validation. The flaw exists in the dispatch function of the MemoryService class, which processes API requests for memory content retrieval. When an attacker supplies a malicious filename containing directory traversal sequences (e.g., ../), the application fails to sanitize these characters before using them in file system operations.

The network-accessible nature of this endpoint means that any system with the chatgpt-on-wechat application exposed to the network is potentially at risk. The exploit has been publicly disclosed, increasing the likelihood of exploitation attempts against unpatched systems.

Root Cause

The root cause of CVE-2026-5998 is insufficient input validation on the filename parameter within the API Memory Content Endpoint. The dispatch function in agent/memory/service.py accepts user-supplied filename values and passes them directly to file system operations without verifying that the resulting path remains within the expected workspace directory. This allows attackers to craft specially formatted filename values that escape the intended directory boundary.

Attack Vector

The attack can be initiated remotely over the network without requiring authentication. An attacker sends a crafted HTTP request to the API Memory Content Endpoint with a malicious filename parameter containing path traversal sequences. The vulnerable application processes this request and attempts to read or access files outside the intended memory storage directory, potentially exposing sensitive system files or application data.

# Security patch in agent/memory/service.py
# Source: https://github.com/zhayujie/chatgpt-on-wechat/commit/174ee0cafc9e8e9d97a23c305418251485b8aa89

             else:
                 return {"action": action, "code": 400, "message": f"unknown action: {action}", "payload": None}
 
+        except ValueError as e:
+            return {"action": action, "code": 403, "message": "invalid filename", "payload": None}
         except FileNotFoundError as e:
             return {"action": action, "code": 404, "message": str(e), "payload": None}
         except Exception as e:

The patch introduces a ValueError exception handler that returns a 403 status code with an "invalid filename" message when path traversal attempts are detected.

Detection Methods for CVE-2026-5998

Indicators of Compromise

• HTTP requests to the Memory Content API endpoint containing ../ or ..\ sequences in the filename parameter
• Unusual file access patterns in application logs showing attempts to read files outside the memory storage directory
• Error logs indicating FileNotFoundError or access attempts to system paths like /etc/passwd or Windows system directories
• Web server logs showing repeated requests with encoded path traversal characters (%2e%2e%2f, %2e%2e/)

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block requests containing path traversal patterns in API parameters
• Configure application logging to capture all filename parameters passed to the Memory Content Endpoint
• Deploy endpoint detection solutions to monitor for anomalous file access patterns from the chatgpt-on-wechat process
• Set up alerts for any 403 responses with "invalid filename" messages after patching, indicating attempted exploitation

Monitoring Recommendations

• Enable verbose logging for the agent/memory/service.py and channel/web/web_channel.py components
• Monitor application error logs for ValueError exceptions related to filename validation
• Track network traffic patterns to the API Memory Content Endpoint for unusual request volumes or payloads
• Implement file integrity monitoring on sensitive directories that could be targeted by path traversal attacks

How to Mitigate CVE-2026-5998

Immediate Actions Required

• Upgrade chatgpt-on-wechat CowAgent to version 2.0.5 or later immediately
• Review application logs for any indicators of prior exploitation attempts
• Audit any sensitive files that may have been exposed through this vulnerability
• If unable to patch immediately, restrict network access to the API Memory Content Endpoint

Patch Information

The vendor has released version 2.0.5 which addresses this vulnerability. The fix is available through the official GitHub release. The specific patch can be found in commit 174ee0cafc9e8e9d97a23c305418251485b8aa89, which adds proper input validation to reject malicious filename values.

The patch modifies both agent/memory/service.py and channel/web/web_channel.py to catch ValueError exceptions when invalid filenames are detected:

# Security patch in channel/web/web_channel.py
# Source: https://github.com/zhayujie/chatgpt-on-wechat/commit/174ee0cafc9e8e9d97a23c305418251485b8aa89

             service = MemoryService(workspace_root)
             result = service.get_content(params.filename)
             return json.dumps({"status": "success", **result}, ensure_ascii=False)
+        except ValueError:
+            return json.dumps({"status": "error", "message": "invalid filename"})
         except FileNotFoundError:
             return json.dumps({"status": "error", "message": "file not found"})
         except Exception as e:

Workarounds

• If immediate patching is not possible, implement a reverse proxy or WAF rule to filter requests containing path traversal sequences in the filename parameter
• Restrict network access to the chatgpt-on-wechat application to trusted IP addresses only
• Apply file system permissions to limit the application's read access to only necessary directories
• Consider running the application in a containerized environment with restricted filesystem access

# Example WAF rule to block path traversal attempts (nginx)
location /api/memory/ {
    if ($args ~* "\.\.") {
        return 403;
    }
    # Additional location configuration
}