Agent-Runtime Identifier Field (run_id/agent_id/session_id/task_id) Carries Path Traversal Into a History/Log File Read
Some AI agent frameworks let tools fetch history, terminal, or log data by combining a run_id, agent_id, session_id, or task_id with a base folder to build a file path. If the framework doesn't check that these values are plain identifiers, an attacker can put '../' or an absolute path like '/etc/passwd' into one of them and read files outside the intended folder.
How the attack works
An agent-callable tool (e.g. history_search, history_tail, terminal_tail, terminal_grep) accepts a run_id or agent_id parameter meant to be a short opaque token like a UUID. The tool joins that value directly into a filesystem path without validating it. An attacker supplies a value containing '../' or a full system path (like '/etc' or '/root') instead of a normal identifier. The tool then reads whatever file that constructed path points to, handing the attacker file contents from outside the intended base directory. This was documented in PraisonAI's Dynamic Context module (GHSA-22cj-m4wf-fv2c), where run_id and agent_id were joined unchecked into a path used to fetch .jsonl history and log files.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 619f4597-6133-4e33-bb02-758d47f94741
- Severity
- High
- CVEs
- CVE-2026-58499
Why it matters
An attacker with low-level access to the agent (prompt injection or tool-calling access) can read arbitrary files on the host running the agent, including logs, credentials, or configuration files outside the intended sandbox directory.
What you can do
- →Validate that run_id, agent_id, session_id, execution_id, and task_id values match a strict allow-list pattern (e.g. UUID or short alphanumeric) before using them in any file path.
- →Reject any identifier containing '../', a leading '/', or drive letters, rather than trying to sanitize or strip them.
- →Resolve the final constructed path and confirm it stays within the intended base directory before opening any file.
- →Run history/log-reading tools with a filesystem permission scope limited to their own base directory, so a traversal attempt cannot reach system files even if validation is missed.
Known benign look-alikes
- A legitimate identifier value that happens to be discussed in prose alongside the word 'traversal' or a path-like example without the field actually being assigned a traversal sequence or absolute system path (e.g. 'validate that run_id never contains ../ before using it' -- no assignment connector directly precedes the traversal marker, so this does not match)
- Documentation showing the vulnerable field/sink relationship as example code, not an actual argument being set
- Ordinary bug-report/chat-style prose using 'to' as a preposition rather than an assignment, e.g. 'point your run_id to ../shared/logs' or 'I changed session_id to /etc/hosts by mistake' -- a bare standalone 'to' is not accepted as a connector, only actual assignment tokens (:, =, 'set to', 'is set to')