Langroid File Tool Path Traversal (ReadFileTool/WriteFileTool)

Technical Analysis

The ReadFileTool and WriteFileTool change the process's working directory to `curr_dir` but never resolve and validate that the final, normalized `file_path` supplied by the tool caller stays within that boundary. An LLM agent, a delegated coding/documentation sub-agent, or any user-influenced tool invocation can pass a `file_path` containing `../` sequences to traverse outside the intended sandbox. The entry point is the tool-call interface exposed to the LLM; because LLM outputs (or upstream prompt injection) directly control `file_path`, an attacker who can influence the model's tool arguments gains arbitrary file read or write on the host, crossing the trust boundary between 'agent operating within a workspace' and 'agent operating on the full filesystem'. This is especially dangerous in multi-agent or delegated-agent setups where a sub-agent is assumed constrained to a project directory but can instead exfiltrate secrets or overwrite arbitrary files.

Affected Systems

Langroid

Detection Signatures

• file_path arguments containing '../' or '..\\' sequences in tool call logs
• ReadFileTool/WriteFileTool invocations resolving to paths outside curr_dir after normalization
• Unexpected file access outside project/workspace root by Langroid-based agent processes
• Write operations creating files in parent directories relative to configured curr_dir

Remediation Steps

1. 1

   Upgrade Langroid

   Update to Langroid version 0.64.0 or later, which patches the path resolution logic in ReadFileTool and WriteFileTool.

2. 2

   Enforce canonical path validation

   Independently validate that resolved absolute paths (via os.path.realpath or equivalent) remain within the intended workspace directory before performing any file operation, regardless of framework-level protections.

3. 3

   Sandbox agent file access

   Run LLM-agent file tools inside a restricted filesystem sandbox (chroot, container, or OS-level permissions) so that even a successful traversal cannot reach sensitive files.

4. 4

   Audit tool argument logs

   Review historical tool-call logs for suspicious file_path values containing traversal sequences to identify potential prior exploitation.

5. 5

   Restrict tool exposure

   Limit exposure of raw file read/write tools to trusted internal agents only; avoid exposing them to untrusted user input or externally reachable delegated agents without additional validation.