CVE-2026-105772
Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions…
- Risk score
- 68/100
- CVSS
- 9.1 v4.0
- Exploit chance (30 days)
- 0.5%
- Published
- 20 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A path traversal vulnerability in FileArtifactService in Google ADK TypeScript allows a remote attacker to read or write files outside the intended storage root. An attacker could exploit this to access sensitive data or disrupt the application.
- Affected
- {'products': ['Google ADK TypeScript'], 'packages': ['@google/adk'], 'versions': ['0.4.0 before 0.6.0']}
- Fix
- Upgrade to @google/adk version 0.6.0 or later
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.1 critical
- Remotely exploitable without logging in
References
Original description
Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 allows a remote unauthenticated attacker to read files matching the artifact directory layout or write files (when an agent tool invokes saveArtifact) outside the intended artifact storage root via crafted relative or percent-encoded path traversal sequences (such as ../ or ..%2F) in the userId or sessionId parameters when the ADK API server is exposed with the non-default FileArtifactService enabled. Applications using the default InMemoryArtifactService are unaffected. Upgrade to @google/adk version 0.6.0 or later.
Last activity 20 Oct 2026. Patch Forecast updates every hour.