An unauthenticated path traversal vulnerability in the Google Cloud Agent Development Kit (ADK) exposes sensitive system files to remote attackers.

The flaw exists within the builder endpoint where improper validation of the file_path query parameter allows an unauthenticated remote attacker to traverse directory structures and access sensitive files on the host system.

Successful exploitation of this vulnerability allows unauthorized access to arbitrary files on the host server, which could include sensitive configuration files, credentials, or proprietary source code. Given the CVSS score of 8.7, this is a high severity issue that carries significant risk of data exfiltration and potential compromise of the underlying infrastructure, necessitating immediate attention to prevent unauthorized data exposure.

Immediate Action: Update the google-adk package to version 1.22.0 or later as provided in the vendor changelog.

Proactive Monitoring: Review web server and application access logs for anomalous requests containing directory traversal sequences, such as dot-dot-slash patterns, targeting the builder endpoint.

Compensating Controls: Implement Web Application Firewall (WAF) rules to inspect incoming traffic and block requests containing path traversal characters or suspicious file path parameters directed at the application.

Public Exploit Available: Unknown

The vulnerability presents a significant risk due to the potential for unauthorized information disclosure without requiring user interaction or authentication. Security teams should prioritize patching affected environments to version 1.22.0 immediately to eliminate the attack vector. If patching is not immediately feasible, restrict access to the builder endpoint via network controls to prevent exposure to untrusted networks.