Path Traversal in Zhayujie Chatgpt-on-wechat Cowagent
CVE-2026-5998
A flaw has been found in zhayujie chatgpt-on-wechat CowAgent up to 2.0.4. This affects the function dispatch of the file agent/memory/service.py of the component API Memory Content Endpoint. This manipulation of the argument filename cause…
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.000 (5.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C.
Affected products
- Zhayujie Chatgpt-on-wechat Cowagent — versions 2.0.0, 2.0.1, 2.0.2
Weakness classification (CWE)
References
- VDB-356552 | zhayujie chatgpt-on-wechat CowAgent API Memory Content Endpoint service.py dispatch path traversal (vdb-entry, technical-description)
- VDB-356552 | CTI Indicators (IOB, IOC, TTP, IOA) (signature, permissions-required)
- Submit #793558 | zhayujie chatgpt-on-wechat (CowAgent) 2.0.4 Path Traversal Leading to Arbitrary File Read (third-party-advisory)
- github.com/zhayujie/chatgpt-on-wechat/issues/2734 (issue-tracking)
- github.com/zhayujie/chatgpt-on-wechat/issues/2734 (exploit, issue-tracking)
- github.com/zhayujie/chatgpt-on-wechat/commit/174ee0cafc9e8e9d97a23c305418251485… (patch)
- github.com/zhayujie/chatgpt-on-wechat/releases/tag/2.0.5 (patch)
Frequently asked questions
- What is CVE-2026-5998?
- CVE-2026-5998 is a medium-severity vulnerability in Zhayujie Chatgpt-on-wechat Cowagent, classified under Path Traversal. CVSS score: 5.3/10. Published 2026-04-10.
- How severe is CVE-2026-5998?
- Medium severity. CVSS v3 base score is 5.3 out of 10.