Skip to content

Hide Navigation Hide TOC

Path Traversal in Agent File Access Requests - ATR-2026-01616 (a37e3eec-119e-5f10-b2ad-c3b31af46a82)

Detects path traversal attacks (../ sequences) in agent file-access tool arguments or user requests to read files outside the agent's authorized working directory. Attackers use "../" sequences to escape the sandboxed directory and read sensitive files: ../README.md (probe project files), ../../etc/passwd (OS credentials), or ../../../../home/user/.ssh/id_rsa (private keys). Targets agents that expose file-reading tools without path normalization or containment checks.

Cluster A Galaxy A Cluster B Galaxy B Level
Path Traversal in Agent File Access Requests - ATR-2026-01616 (a37e3eec-119e-5f10-b2ad-c3b31af46a82) Agent Threat Rules File and Directory Discovery - T1083 (7bc57495-ea59-4380-be31-a64af124ef18) Attack Pattern 1
Path Traversal in Agent File Access Requests - ATR-2026-01616 (a37e3eec-119e-5f10-b2ad-c3b31af46a82) Agent Threat Rules Craft Adversarial Data (a7c30122-b393-4265-91b7-57cd1211e3f9) MITRE ATLAS Attack Pattern 1