CVE-2026-79407: MetaGPT Path Traversal Vulnerability

CVE-2026-79407 Overview

CVE-2026-79407 is a path traversal vulnerability in the Self-Prompt Optimizer (SPO) extension of MetaGPT 0.8.1. The flaw resides in metagpt/ext/spo/utils/load.py, where the set_file_name() and load_meta_data() functions join an attacker-controlled FILE_NAME value with the settings directory. The resulting path is opened without verifying that it resolves within the intended directory, allowing arbitrary file reads on the host filesystem. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Remote attackers can read arbitrary files from the underlying filesystem without authentication, exposing configuration files, credentials, and sensitive application data.

Affected Products

MetaGPT 0.8.1
SPO extension component (metagpt/ext/spo/utils/load.py)
Deployments exposing the SPO extension to untrusted input

Discovery Timeline

2026-08-31 - CVE-2026-79407 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-79407

Vulnerability Analysis

MetaGPT is a multi-agent framework that orchestrates large language model workflows. The SPO (Self-Prompt Optimizer) extension loads YAML metadata files from a designated settings directory. Two functions, set_file_name() and load_meta_data() in metagpt/ext/spo/utils/load.py, accept a FILE_NAME parameter and concatenate it directly with the base settings path.

The code opens the resulting path without normalizing it or confirming containment within the intended directory. An attacker who controls the FILE_NAME value can supply traversal sequences such as ../../../../etc/passwd to escape the settings directory. The file read succeeds because the process inherits the privileges of the MetaGPT runtime user.

Content confidentiality is the primary impact. Attackers cannot write or modify files through this specific code path, and system availability remains unaffected.

Root Cause

The root cause is missing path canonicalization and containment validation. The vulnerable functions rely on naive string joining rather than resolving the absolute path and comparing it against the allowed base directory. Any input that traverses upward through the directory tree is accepted verbatim.

Attack Vector

Exploitation occurs over the network wherever the SPO extension consumes FILE_NAME from untrusted sources. No authentication or user interaction is required. An attacker supplies a crafted FILE_NAME value containing directory traversal sequences, and the application returns the contents of the referenced file. See the public proof-of-concept for exploitation details.

Detection Methods for CVE-2026-79407

Indicators of Compromise

Requests or configuration values where FILE_NAME contains traversal sequences such as ../, ..\, or URL-encoded equivalents (%2e%2e%2f)
Application logs showing file reads from paths outside the MetaGPT SPO settings directory
Unexpected access to sensitive files such as /etc/passwd, .env, SSH keys, or cloud credential files by the MetaGPT process

Detection Strategies

Instrument set_file_name() and load_meta_data() to log every resolved path and flag paths outside the settings directory
Deploy web application firewall rules that detect path traversal patterns in parameters passed to MetaGPT endpoints
Correlate MetaGPT process file-access telemetry with allowlists of expected configuration paths

Monitoring Recommendations

Enable filesystem audit logging on hosts running MetaGPT and alert on reads to sensitive paths by the application user
Monitor egress traffic from MetaGPT hosts for unexpected data volumes that could indicate file exfiltration
Review application logs regularly for repeated failed or anomalous file loads within the SPO extension

How to Mitigate CVE-2026-79407

Immediate Actions Required

Restrict network exposure of MetaGPT SPO endpoints and require authentication in front of the service
Audit any interfaces that pass user-controlled input into FILE_NAME and add allowlist validation
Run MetaGPT under a dedicated low-privilege account with filesystem access limited to required directories

Patch Information

No vendor advisory or patched release is listed in the NVD entry at the time of publication. Track the MetaGPT repository for a fixed version and apply it once available. Until then, apply the workarounds below.

Workarounds

Validate FILE_NAME against a strict allowlist of expected filenames before it reaches the loader functions
Resolve the joined path with os.path.realpath() (or pathlib.Path.resolve()) and reject any path that does not start with the intended settings directory
Reject any FILE_NAME containing .., absolute path prefixes, or NULL bytes prior to processing
Apply mandatory access controls (AppArmor, SELinux) that confine the MetaGPT process to its expected file paths

bash

# Example containment check to apply before opening the file
RESOLVED=$(realpath -m "$SETTINGS_DIR/$FILE_NAME")
case "$RESOLVED" in
  "$SETTINGS_DIR"/*) echo "path allowed" ;;
  *) echo "path traversal blocked"; exit 1 ;;
esac