-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| python-a2a | pip | < 0.5.6 | 0.5.6 |
Miggo AIRoot Cause AnalysisThe vulnerability is a path traversal in the create_workflow function, located in python_a2a/agent_flow/server/api.py. The root cause is the lack of sanitization of the id field within the JSON payload received by this endpoint. This id is subsequently used by the save_workflow method in python_a2a/agent_flow/storage/workflow_storage.py to construct a file path. An attacker can provide a malicious id containing path traversal sequences (e.g., ../), which allows them to write a workflow JSON file to an arbitrary location on the filesystem, relative to the application's workflow storage directory. The create_workflow function is vulnerable because it processes the malicious input, and save_workflow is vulnerable because it uses this unsanitized input to perform a file system operation.