CVE-2026-37007: Path traversal — CRITICAL

CISO Take

A path traversal flaw in the built-in FileWriterTool of crewai-tools (versions up to 1.10.2rc1) lets an attacker supply crafted '../' sequences in the filename argument to write files outside the tool's intended output directory, ultimately enabling remote code execution. CrewAI is a widely adopted multi-agent orchestration framework, and FileWriterTool is a stock tool many agent builders wire up to let agents persist output to disk — meaning any deployment that exposes this tool to user input or LLM-generated arguments (including via prompt injection) inherits the flaw. There is no CVSS score, EPSS data, CISA KEV listing, public exploit, or Nuclei template available yet, and the advisory was only published 2026-08-27, so this should be treated as an unconfirmed-severity but plausible RCE rather than an active-exploitation emergency. The maintainers have already shipped a fix (commit 713fa7d in crewAIInc/crewAI); teams running crewai-tools should upgrade past 1.10.2rc1 immediately and, in the meantime, restrict FileWriterTool's writable path scope and treat any LLM-controlled filename argument as untrusted input requiring strict sanitization.

Sources:NVDGitHub (crewAIInc/crewAI repository)ATLASyerangamage.com

What is the risk?

Severity is currently unrated (no CVSS vector published), which understates the practical risk: a path traversal bug in a filesystem-write tool that is designed to be invoked by an LLM agent is a direct line to code execution if the written file lands somewhere executable (a cron directory, a web-served path, an imported Python module, etc.). Exploitability depends heavily on deployment: if an application lets end users or untrusted content influence the filename/content arguments passed to FileWriterTool — directly via an API, or indirectly via prompt injection that manipulates the agent into calling the tool with attacker-chosen parameters — exploitation is straightforward (classic CWE-22 path traversal, no novel technique required). No public exploit code, Nuclei template, or CISA KEV listing exists yet, and EPSS/exploit-maturity data is unavailable, so real-world exploitation likelihood cannot currently be quantified; this should be reassessed as scanner/exploit tooling emerges.

How does the attack unfold?

Malicious tool invocation

An attacker, directly or via prompt injection, causes the crewai agent to invoke FileWriterTool with a filename argument containing path traversal sequences.

AML.T0053

Path traversal write

FileWriterTool fails to sanitize the filename, allowing the write operation to escape the intended output directory and land at an arbitrary filesystem path.

AML.T0010.005

Malicious file execution

The attacker-controlled file (script, cron entry, or application code) is subsequently executed by the host, converting the write primitive into code execution.

AML.T0050

Host compromise

The attacker gains remote code execution on the machine running the AI agent, enabling further pivoting to connected credentials and systems.

AML.T0112

Malicious tool invocation

An attacker, directly or via prompt injection, causes the crewai agent to invoke FileWriterTool with a filename argument containing path traversal sequences.

AML.T0053

Path traversal write

FileWriterTool fails to sanitize the filename, allowing the write operation to escape the intended output directory and land at an arbitrary filesystem path.

AML.T0010.005

Malicious file execution

The attacker-controlled file (script, cron entry, or application code) is subsequently executed by the host, converting the write primitive into code execution.

AML.T0050

Host compromise

The attacker gains remote code execution on the machine running the AI agent, enabling further pivoting to connected credentials and systems.

AML.T0112

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

1.0%

chance of exploitation in 30 days

Higher than 63% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

Upgrade crewai-tools past the vulnerable 1.10.2rc1 baseline once a formally versioned patch release is available, or apply the fix in commit https://github.com/crewAIInc/crewAI/commit/713fa7d directly if pinned to a pre-patch revision. Until upgraded, restrict FileWriterTool's allowed output directory via an explicit allow-list/base-path check at the application layer (reject any resolved path that escapes the intended root), and never pass raw LLM- or user-generated strings directly as filenames without canonicalizing and validating them server-side. Run agent processes under least-privilege service accounts with a chroot/sandboxed or read-only filesystem where possible so a write-primitive cannot reach sensitive paths. For detection, monitor for file writes outside expected agent output directories and alert on filenames containing traversal sequences ('../', encoded variants) reaching tool-invocation logs.

What does CISA's SSVC say?

DecisionTrack*

Exploitationnone

AutomatableYes

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionSupply ChainAgentPluginFrameworkAML.T0010.005- AI Agent Tool AML.T0050- Command and Scripting Interpreter AML.T0053- AI Agent Tool Invocation AML.T0112- Machine Compromise

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.2-Third-party and customer relationships / supplier AI components

NIST AI RMF

MEASURE 2.7-AI system security and resilience evaluation

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-37007?

A path traversal flaw in the built-in FileWriterTool of crewai-tools (versions up to 1.10.2rc1) lets an attacker supply crafted '../' sequences in the filename argument to write files outside the tool's intended output directory, ultimately enabling remote code execution. CrewAI is a widely adopted multi-agent orchestration framework, and FileWriterTool is a stock tool many agent builders wire up to let agents persist output to disk — meaning any deployment that exposes this tool to user input or LLM-generated arguments (including via prompt injection) inherits the flaw. There is no CVSS score, EPSS data, CISA KEV listing, public exploit, or Nuclei template available yet, and the advisory was only published 2026-08-27, so this should be treated as an unconfirmed-severity but plausible RCE rather than an active-exploitation emergency. The maintainers have already shipped a fix (commit 713fa7d in crewAIInc/crewAI); teams running crewai-tools should upgrade past 1.10.2rc1 immediately and, in the meantime, restrict FileWriterTool's writable path scope and treat any LLM-controlled filename argument as untrusted input requiring strict sanitization.

Is CVE-2026-37007 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-37007, increasing the risk of exploitation.

How to fix CVE-2026-37007?

Upgrade crewai-tools past the vulnerable 1.10.2rc1 baseline once a formally versioned patch release is available, or apply the fix in commit https://github.com/crewAIInc/crewAI/commit/713fa7d directly if pinned to a pre-patch revision. Until upgraded, restrict FileWriterTool's allowed output directory via an explicit allow-list/base-path check at the application layer (reject any resolved path that escapes the intended root), and never pass raw LLM- or user-generated strings directly as filenames without canonicalizing and validating them server-side. Run agent processes under least-privilege service accounts with a chroot/sandboxed or read-only filesystem where possible so a write-primitive cannot reach sensitive paths. For detection, monitor for file writes outside expected agent output directories and alert on filenames containing traversal sequences ('../', encoded variants) reaching tool-invocation logs.

What systems are affected by CVE-2026-37007?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent tool integrations, autonomous multi-agent pipelines with filesystem write access.

What is the CVSS score for CVE-2026-37007?

CVE-2026-37007 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.99%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent tool integrationsautonomous multi-agent pipelines with filesystem write access

MITRE ATLAS Techniques

AML.T0010.005AI Agent Tool

AML.T0050Command and Scripting Interpreter

AML.T0053AI Agent Tool Invocation

AML.T0112Machine Compromise

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.10.2

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

A vulnerability in FileWriterTool in crewai-tools <= 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the filename argument.

Exploitation Scenario

An organization deploys a customer-facing support or research assistant built on crewai, wiring FileWriterTool so the agent can save generated reports to a working directory. An attacker interacting with the assistant — either by directly controlling an exposed filename parameter or by embedding a prompt injection payload in content the agent processes (e.g., a document it's asked to summarize) — steers the agent into invoking FileWriterTool with a filename like '../../../../etc/cron.d/task' or a path landing inside the application's own code directory. The unsanitized write lands outside the intended output folder, planting a malicious script or scheduled job that executes with the host's privileges, giving the attacker remote code execution and a foothold to pivot to any credentials or connected systems accessible from that host.