CVE-2026-90691: HexStrike AI Path Traversal Vulnerability

CVE-2026-90691 Overview

CVE-2026-90691 is a path traversal vulnerability [CWE-22] affecting 0x4m4 HexStrike AI up to commit d689933ff579d839c676c82b231f8e98326c5f04. The flaw resides in the FileOperationsManager function within hexstrike_server.py, part of the API Files Endpoint component. Attackers can manipulate the filename argument to traverse outside the intended directory. The attack is executable remotely without authentication or user interaction. Exploit details have been publicly disclosed, and the maintainer has not responded to the initial issue report.

Critical Impact
Unauthenticated remote attackers can read or write files outside the intended directory by manipulating the filename parameter passed to the HexStrike AI API Files Endpoint.

Affected Products

0x4m4 HexStrike AI up to commit d689933ff579d839c676c82b231f8e98326c5f04
Component: API Files Endpoint (hexstrike_server.py)
Function: FileOperationsManager

Discovery Timeline

2026-09-14 - CVE-2026-90691 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90691

Vulnerability Analysis

The vulnerability exists in the FileOperationsManager function within hexstrike_server.py. This function processes requests to the API Files Endpoint and accepts a user-supplied filename argument. The server fails to sanitize or canonicalize this argument before using it in file system operations. As a result, an attacker can supply traversal sequences such as ../ to reference files outside the intended working directory.

Because HexStrike AI exposes this endpoint over the network, exploitation requires no local access or authentication. The impact scope covers confidentiality, integrity, and availability at a limited level, since attackers may read, overwrite, or delete files accessible to the server process.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The FileOperationsManager code path trusts the filename argument and concatenates it into a file system path without validating that the resolved path stays within the intended base directory. Missing checks include path normalization, allow-listed directory enforcement, and rejection of traversal sequences.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request to the API Files Endpoint with a filename value containing directory traversal sequences. The server resolves the manipulated path relative to its base directory and performs the requested file operation on the attacker-chosen path. This may expose configuration files, credentials, source code, or other sensitive artifacts. Where write or delete operations are supported, the flaw enables tampering with server files. See the GitHub Issue #135, GitHub Issue #225, and GitHub Pull Request #159 for reported exploitation details.

No verified proof-of-concept code is included here. Refer to the VulDB entry for CVE-2026-90691 and the linked GitHub issues for public disclosure details.

Detection Methods for CVE-2026-90691

Indicators of Compromise

HTTP requests to the HexStrike AI API Files Endpoint containing ../, ..\, URL-encoded (%2e%2e%2f), or double-encoded traversal sequences in the filename parameter.
Access log entries showing file operations targeting paths outside the HexStrike AI working directory, such as /etc/passwd, /etc/shadow, or application secret files.
Unexpected reads, writes, or deletions of files owned by the user running hexstrike_server.py.

Detection Strategies

Inspect web server and application logs for requests to the API Files Endpoint that include traversal metacharacters in the filename argument.
Deploy a web application firewall rule that blocks path traversal payloads targeting the HexStrike AI API surface.
Compare file access patterns from the hexstrike_server.py process against a baseline of expected paths.

Monitoring Recommendations

Enable verbose logging on the HexStrike AI server and forward events to a centralized logging or SIEM platform for correlation.
Alert on file system access outside the designated HexStrike AI data directory by the server process.
Track outbound network activity from the HexStrike AI host to detect follow-on exfiltration of files retrieved via traversal.

How to Mitigate CVE-2026-90691

Immediate Actions Required

Restrict network exposure of the HexStrike AI API Files Endpoint to trusted management networks only, using firewall rules or reverse proxy access controls.
Run hexstrike_server.py under a low-privilege service account that has read and write access only to the intended data directory.
Review server access logs for prior exploitation attempts referencing traversal sequences in the filename parameter.

Patch Information

As of publication, the maintainer of 0x4m4 HexStrike AI has not responded to the reported issue. Monitor the upstream repository, including the pending GitHub Pull Request #159, for a fix. Until an official patch is released, apply the workarounds below.

Workarounds

Place the HexStrike AI server behind a reverse proxy that normalizes request paths and rejects filename values containing .., absolute paths, or encoded traversal sequences.
Apply a local code modification to FileOperationsManager that canonicalizes the resolved path and rejects any result that does not begin with the allowed base directory.
Use mandatory access controls such as AppArmor or SELinux to confine the HexStrike AI process to a specific directory subtree.
If the API Files Endpoint is not required, disable it or block the route at the reverse proxy layer.

bash

# Example NGINX reverse proxy rule to block traversal payloads targeting HexStrike AI
location /api/files {
    if ($request_uri ~* "(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/|/%2e%2e)") {
        return 403;
    }
    proxy_pass http://127.0.0.1:8888;
}