highAug 13, 2026

atomic-agents-stack: Dashboard HTTP Server Path Traversal Allows Arbitrary File Read

Rohit Hatagale
AI Security Researcher, SecureLayer7

The built-in dashboard web server in atomic-agents-stack served files from any path the attacker requested, letting anyone who can reach the port read files outside the intended directory, including…

Packageatomic-agents-stack
Ecosystempip
Affected<= 1.0.0
Fixed in1.1.0
atomic-agents-stack: Dashboard HTTP Server Path Traversal Allows Arbitrary File Read

The problem

The optional dashboard HTTP server (atomic_agents/dashboard/serve.py) builds filesystem paths by joining the HTTP request path directly onto agents_root using Python's pathlib.Path. No containment check is performed before the file is opened and sent.

Literal ../ segments survive both urlparse and Path joining unchanged. An attacker who can reach the server, whether on loopback via DNS-rebinding or SSRF, or on the LAN when --host 0.0.0.0 is used, can read any file the process user can access.

Proof of concept

A working proof-of-concept for this issue in atomic-agents-stack, with the exact payload below.

http
GET /../../../../etc/passwd HTTP/1.1
Host: 127.0.0.1:8080

Python's pathlib.Path(root) / user_input does not canonicalize or strip ../ segments before the path is resolved on disk. do_GET passed the raw urlparse-decoded path straight into _serve_file, which opened and returned the resolved file with no boundary check.

The fix routes every incoming path through _io.safe_resolve_under(agents_root, requested_path) before opening anything. If the resolved absolute path does not start with agents_root, a PathTraversalError is raised and the handler returns HTTP 404. Early rejection of .. components and path separators was also added as a defense-in-depth layer.

The fix

Upgrade to atomic-agents-stack 1.1.0. The patched release (commit ec474f4) routes all served paths through _io.safe_resolve_under and returns 404 on PathTraversalError. If you cannot upgrade immediately, do not expose the dashboard server on a non-loopback interface and firewall the port.

Reported by dep0we.

References: [1][2][3]

Related research