Agno PythonTools Path Traversal Enabling Arbitrary File Access and Code Execution
First seen Aug 20, 2026 · Updated Aug 20, 2026 · CVSS 8.8
Agno's PythonTools contains a path traversal flaw that lets an attacker escape the intended sandboxed base_dir by supplying '../' sequences in file arguments to read_file, save_to_file, or run_python_file. This can be triggered either through direct tool calls or by embedding traversal payloads in content the agent processes (prompt injection), resulting in arbitrary file read, write, or code execution at the privilege level of the agent process. Given the high CVSS score and ease of exploitation, this is a critical, actively exploitable vulnerability rather than a theoretical concern.
Technical Analysis
The vulnerability resides in file_name handling within libs/agno/agno/tools/python.py, where user- or content-supplied paths are not canonicalized or validated against the configured base_dir before being used in file I/O or Python execution calls. An attacker can supply a crafted file_name (e.g., containing '../../../../etc/passwd') either via direct tool invocation or by hiding such a string inside untrusted content that an LLM agent later passes into the tool call — a classic prompt injection vector that crosses the boundary between untrusted data and privileged tool execution. Successful exploitation grants arbitrary file read (credential/secret theft), arbitrary file write (persistence, config tampering), or arbitrary code execution via run_python_file, all within the authority of the process running the agent. This breaks the tool-layer sandboxing model that agent frameworks rely on to constrain LLM-directed file operations to a safe working directory.
Affected Systems
Agno
Detection Signatures
- File arguments containing '../' or '..\\' sequences passed to read_file, save_to_file, or run_python_file tool calls
- Tool call parameters resolving to absolute paths outside configured base_dir (e.g., /etc/, /root/, C:\\Windows\\)
- Unexpected file writes/reads outside the agent's sandboxed working directory in tool execution logs
- Agent-processed content (documents, web pages, tool outputs) containing embedded path traversal strings
- run_python_file invoked with file_name arguments not matching expected project file naming patterns
Remediation Steps
- 1
Upgrade Agno
Update to the patched Agno release that resolves the PythonTools path traversal vulnerability as soon as it is available.
- 2
Canonicalize and validate paths
Resolve all file_name inputs to an absolute path and verify it is strictly contained within base_dir before any file or execution operation; reject inputs containing traversal sequences.
- 3
Sandbox tool execution
Run PythonTools (especially run_python_file) inside a restricted environment (container, chroot, restricted OS user) so path traversal cannot reach sensitive host files even if the check is bypassed.
- 4
Sanitize untrusted content before tool invocation
Treat any file path or filename value derived from LLM-processed external content as untrusted; enforce allowlists of permitted filenames/extensions rather than blocklisting traversal patterns.
- 5
Monitor and alert
Add logging and alerting for tool calls that resolve outside the expected base_dir, and for anomalous file access patterns following agent content ingestion.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.