A path traversal vulnerability in the SWE-agent trajectory inspector allows unauthenticated remote attackers to perform unauthorized file disclosure, potentially leading to the exposure of sensitive system data.

The vulnerability is a Path Traversal (CWE-22) issue within the sweagent inspector component. It occurs because the software fails to properly sanitize user-supplied input, allowing an attacker to navigate outside the intended directory and access sensitive files on the host filesystem.

The ability to perform unauthorized file reads presents a high risk of information disclosure, including the potential exposure of configuration files, credentials, or source code. With a CVSS score of 7.5, the impact is substantial, as it may provide attackers with the necessary intelligence to escalate privileges or conduct further attacks against the infrastructure.

Immediate Action: Update the SWE-agent software to the latest available version that includes the security fix for the trajectory inspector.

Proactive Monitoring: Monitor system logs for file access attempts that contain directory traversal sequences such as dot-dot-slash patterns.

Compensating Controls: Ensure the service runs with the principle of least privilege, restricting the filesystem access of the process to the minimum necessary directory scope.

Public Exploit Available: Unknown.

Organizations utilizing SWE-agent should prioritize upgrading their instances to address this path traversal vulnerability. Restricting network access to the trajectory inspector component is recommended until the patch is applied.