Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-85685— AgentScope through 2.0.7.post1 Arbitrary Directory Copy via add_skill

Quick assessment

Affected
agentscope-ai agentscope
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

AgentScope-AI AgentScope是AgentScope-AI组织的一个多智能体应用开发框架。 AgentScope-AI AgentScope 2.0.7.post1及之前版本存在路径遍历漏洞，该漏洞源于LocalWorkspace.add_skill存在路径遍历问题，允许通过不受限制的源路径参数将任意服务器目录复制到代理工作区，攻击者可利用skill_path请求参数指定任意目录路径，导致文件被复制到技能目录并通过工作区技能列表被访问。

CVSS 7.5 · High EPSS 0.55% · P45

Affected Version Matrix 1

VendorProduct Version RangeStatus
agentscope-ai agentscope ≤ 2.0.7.post1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-85685

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
AgentScope through 2.0.7.post1 Arbitrary Directory Copy via add_skill
Source: CVE Program / CVE List V5
Vulnerability Description
AgentScope through 2.0.7.post1 contains a path traversal vulnerability in LocalWorkspace.add_skill that copies arbitrary server directories into the agent workspace via an unconfined source path parameter. Attackers can supply any directory path in the skill_path request parameter to copy files into the skills directory, making them accessible through the workspace skill listing.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
AgentScope-AI AgentScope 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
AgentScope-AI AgentScope是AgentScope-AI组织的一个多智能体应用开发框架。 AgentScope-AI AgentScope 2.0.7.post1及之前版本存在路径遍历漏洞，该漏洞源于LocalWorkspace.add_skill存在路径遍历问题，允许通过不受限制的源路径参数将任意服务器目录复制到代理工作区，攻击者可利用skill_path请求参数指定任意目录路径，导致文件被复制到技能目录并通过工作区技能列表被访问。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
agentscope-ai agentscope 0 ~ 2.0.7.post1 -

II. Public POCs for CVE-2026-85685

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-85685

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-85685 (1)

Proof of Concept for CVE-2026-85685 (1)

Other References for CVE-2026-85685 (1)

IV. Related Vulnerabilities

Same product: agentscope
Same weakness: CWE-22

V. Comments for CVE-2026-85685

No comments yet

Leave a comment