AIKIDO-2026-423732
cuga is vulnerable to Path Traversal
75
High Risk
This Affects:
cugaTL;DR
The ingest_knowledge MCP tool in the knowledge server opens a caller-supplied file_path after only an existence check, skipping the resolve_workspace_path containment guard used by other filesystem operations. Because the path comes directly from model or task input, a traversal or host-absolute path such as /etc/passwd or ../../.env escapes the agent workspace. The file contents are then indexed into the knowledge base and retrievable through search_knowledge, exposing secrets such as model-provider API keys. The fix routes ingest paths through a _resolve_ingest_file_path wrapper that enforces workspace containment and rejects paths outside the virtual workspace root.
Who does this affect?
You are affected if you deploy the CUGA knowledge MCP server and the ingest_knowledge tool can be driven by untrusted or model-controlled task input.
Background info
cuga is vulnerable to Path Traversal in versions 0.0.1 - 0.3.0.
How to fix this
Upgrade the cuga library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant