CVE-2026-85685

CVE-2026-85685 is a path traversal vulnerability (CWE-22) in the LocalWorkspace.add_skill routine of AgentScope, an open-source framework for building LLM-based agent applications, affecting all versions through 2.0.7.post1. Because add_skill does not confine the source path supplied in the skill_path request parameter, an attacker can pass any directory path on the server and have the workspace copy that directory into its skills directory. The copied files then become accessible through the workspace skill listing, giving an unauthenticated, network-reachable attacker read access to arbitrary server directories, which is why CVSS 4.0 scores this 8.7 (High) with a High confidentiality impact and no integrity or availability impact. Any deployment running AgentScope up to and including 2.0.7.post1 whose LocalWorkspace API is reachable over the network is affected, with developer and self-hosted deployments being the most plausible targets. There is no public proof-of-concept, the issue is not in CISA KEV, and EPSS estimates a 0.5% probability of exploitation within 30 days (38th percentile), so no exploitation is currently known.

What to do: Upgrade AgentScope to a version newer than 2.0.7.post1 as soon as a patched release is published (no fixed version is specified in the available data) or apply vendor guidance for LocalWorkspace.add_skill. Until then, restrict network access to the workspace API to trusted and authenticated clients and confine or validate the skill_path parameter to workspace-relative or whitelisted paths. Check workspace skill listings for directories copied from unexpected server locations, as that would indicate the flaw has been triggered.