High, CVSS 8.2PyPIAmendedPublished
EverOS: Path traversal in EverOS /api/v1/memory/add via unvalidated sender_id
CVE-2026-58499 · GHSA-c795-2g9c-j48m
- Affected
- PyPI everos <= 1.0.0
- Fixed in
- 1.0.1· Vendor fix available
- Issue
- EverOS versions 1.0.0 and earlier are vulnerable to path traversal in the POST /api/v1/memory/add ingestion endpoint. The per-message senderid field was not validated as a path-safe identifier (unlike appid / projectid, which already enforced this). During user-memory extraction, senderid is used as the ownerid and joined into the filesystem path where the extracted episode is persisted as a Markdown file. A senderid containing ../ sequences could direct the write outside the configured memory root, allowing an unauthenticated caller to create or overwrite .md files at locations writable by the server process (unauthorized arbitrary file write). The file content is partially attacker-influenced. Patch: Fixed in v1.0.1 with (1) path-safe validation on senderid (character whitelist plus rejection of the . and .. tokens) and (2) a defense-in-depth containment check in the Markdown writer that rejects any write resolving outside the memory root before any filesystem access, covering both…
Recommended action: Upgrade to 1.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.