CVE-2026-85685 Overview
CVE-2026-85685 is a path traversal vulnerability [CWE-22] in AgentScope through version 2.0.7.post1. The flaw resides in the LocalWorkspace.add_skill method, which copies arbitrary server directories into the agent workspace through an unconfined source path parameter. An unauthenticated remote attacker can supply any directory path in the skill_path request parameter. The server copies files from that location into the skills directory, exposing them through the workspace skill listing. This turns a workspace management feature into an arbitrary file read primitive against the AgentScope host.
Critical Impact
Unauthenticated attackers can copy arbitrary directories from the AgentScope host into the agent workspace, exposing sensitive files including credentials, source code, and configuration data.
Affected Products
- AgentScope through 2.0.7.post1
- The agentscope.workspace._local_workspace module
- Deployments exposing the AgentScope skill management endpoint
Discovery Timeline
- 2026-09-04 - CVE-2026-85685 published to NVD
- 2026-09-04 - Last updated in NVD database
Technical Details for CVE-2026-85685
Vulnerability Analysis
AgentScope is an open-source framework for building multi-agent LLM applications. The LocalWorkspace component manages per-agent artifacts, including a skills directory that holds reusable skill definitions. The add_skill method accepts a skill_path parameter identifying a source directory to import. The implementation copies the entire referenced directory into the workspace without validating that the path resolves inside an allowed base directory.
Because the API accepts an absolute or relative path from the request, an attacker can point skill_path at any location on the host filesystem. The copied content becomes readable through the workspace skill listing, converting a directory copy operation into an arbitrary file disclosure channel.
Root Cause
The root cause is missing path confinement in LocalWorkspace.add_skill. The method does not canonicalize the incoming path, does not verify that the resolved path stays under an approved skills source root, and does not enforce an allowlist. See the GitHub Local Workspace Script and GitHub Issue #2069 for the affected code and maintainer discussion.
Attack Vector
Exploitation requires only network access to the AgentScope service. The attacker issues a skill registration request with skill_path set to a sensitive directory, for example /etc, /root/.ssh, or an application configuration folder. The server copies the directory tree into the workspace skills location. The attacker then reads the copied contents through the standard workspace skill listing API. See the VulnCheck Advisory for AgentScope for the full advisory.
Detection Methods for CVE-2026-85685
Indicators of Compromise
- Requests to the AgentScope add_skill endpoint containing absolute paths or .. sequences in the skill_path parameter.
- Unexpected directories appearing under the workspace skills folder that mirror host paths such as etc, ssh, or application config directories.
- Skill listing responses that surface files unrelated to legitimate agent skills, such as private keys, .env files, or shadow files.
Detection Strategies
- Instrument the AgentScope service to log every skill_path value passed to LocalWorkspace.add_skill and alert on paths outside the intended skills source root.
- Monitor filesystem activity on hosts running AgentScope for read access to sensitive directories originating from the AgentScope process.
- Deploy web application firewall rules that inspect JSON bodies to the skill registration endpoint for path traversal patterns and absolute filesystem paths.
Monitoring Recommendations
- Baseline the contents of workspace skills directories and alert on new entries whose source path is outside the expected repository.
- Correlate AgentScope access logs with authentication telemetry to identify unauthenticated skill registration attempts.
- Track outbound data volume from AgentScope hosts to identify bulk exfiltration following successful directory copies.
How to Mitigate CVE-2026-85685
Immediate Actions Required
- Restrict network exposure of AgentScope instances to trusted internal networks and place them behind authenticated reverse proxies.
- Disable or gate the add_skill endpoint until a patched release is available.
- Audit workspace skills directories for entries copied from unexpected host paths and rotate any credentials that may have been exposed.
Patch Information
At the time of publication, no fixed version is referenced in the NVD entry. Track the upstream GitHub AgentScope Repository and GitHub Issue #2069 for a release that adds path confinement to LocalWorkspace.add_skill. Upgrade beyond 2.0.7.post1 once a fixed version is published.
Workarounds
- Run AgentScope under a low-privilege service account with a restricted filesystem view, for example inside a container with only the required directories mounted.
- Apply mandatory access controls such as AppArmor or SELinux profiles that deny the AgentScope process read access to sensitive host paths.
- Front the AgentScope API with a proxy that validates skill_path against an allowlist of approved directories before forwarding requests.
# Example AppArmor-style restriction concept for the AgentScope process
# Allow only the intended skills source and workspace directories
/opt/agentscope/skills_src/** r,
/var/lib/agentscope/workspaces/** rw,
deny /etc/** r,
deny /root/** r,
deny /home/*/.ssh/** r,
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
