6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-3pw3-v88x-xj24

GHSA-3pw3-v88x-xj24: Paperclip: Arbitrary File Read via Agent-Controlled adapterConfig.instructionsFilePath

Summary

Paperclip contains an arbitrary file read vulnerability that allows an attacker with an Agent API key to read files from the Paperclip server host filesystem. The vulnerability occurs because agents are allowed to modify their own adapterConfig through the /agents/:id API endpoint. The configuration field adapterConfig.instructionsFilePath is later read directly by the server runtime using fs.readFile(). Because no validation or path restriction is applied, an attacker can supply an arbitrary filesystem path. The Paperclip server then attempts to read that path from the host filesystem during agent execution. This breaks the intended trust boundary between agent runtime configuration and server host filesystem access, allowing a compromised or malicious agent to access sensitive files on the host system.

Details

Root Cause

No path normalization, allowlist, or workspace boundary validation is applied before the filesystem read occurs. Agent configuration can be modified through the API endpoint:

PATCH /api/agents/:id

The validation schema allows arbitrary configuration fields inside adapterConfig. File:

packages/shared/src/validators/agent.ts

Schema fragment:

adapterConfig: z.record(z.unknown())

Because of this schema, attackers can inject arbitrary configuration values, including:

adapterConfig.instructionsFilePath

During agent execution, the server runtime reads this path directly from the host filesystem using fs.readFile(). Relevant code path:

packages/adapters/claude-local/src/server/execute.ts

Execution flow:

adapterConfig.instructionsFilePath
        ↓
execute()
        ↓
fs.readFile(instructionsFilePath)
        ↓
file content loaded into runtime

Vulnerable logic:

const instructionsContent = await fs.readFile(instructionsFilePath, "utf-8");

Because the value originates from attacker-controlled configuration and no validation or sandboxing is applied, this becomes a direct host filesystem read primitive.

Miggo Vulnerability Database

→

GHSA-3pw3-v88x-xj24

GHSA-3pw3-v88x-xj24:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@paperclipai/shared	npm	< 2026.416.0	2026.416.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis:

In progress

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

6.5

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-3pw3-v88x-xj24: Paperclip: Arbitrary File Read via Agent-Controlled adapterConfig.instructionsFilePath

Summary

Details

Root Cause

GHSA-3pw3-v88x-xj24:

6.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

6.5

6.5

Technical Details

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

GHSA-3pw3-v88x-xj24: Paperclip: Arbitrary File Read via Agent-Controlled adapterConfig.instructionsFilePath

Summary

Details

Root Cause

Affected Files

Attacker Model

Attacker Chain

Trust Boundary Violation

Why This Is a Vulnerability (Not Expected Behavior)

PoC

Step 1 — Setup Environment

Step 2 — Obtain Agent API key

Step 3 — Identify agent ID

Step 4 — Inject malicious configuration

Step 6 — Observe server log

Impact

Recommended Fix

Restrict configuration authority

Path validation

Avoid direct filesystem reads from configuration

Security Impact Statement

Disclosure

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI