CVE-2026-39981

CVE-2026-39981 affects AGiXT, a dynamic AI Agent Automation Platform, in versions prior to 1.9.2. The vulnerability exists in the safe_join() function within the essential_abilities extension, which fails to properly validate that resolved file paths remain confined to the designated agent workspace. This flaw allows authenticated attackers to exploit directory traversal sequences to read, write, or delete arbitrary files on the affected server. The vulnerability carries a CVSS score of 8.8 (HIGH) with a network-based attack vector, low attack complexity, and low privilege requirements. The impact is severe across all security dimensions: attackers can achieve high confidentiality impact through unauthorized file access, high integrity impact through file modification or deletion, and high availability impact through potential system disruption. There is no current evidence of active exploitation in the wild, as the vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat intelligence hot lists. The EPSS score of 0.005 indicates lower predictive likelihood of exploitation compared to other CVEs, though organizations running AGiXT versions prior to 1.9.2 should prioritize patching given the high severity rating and the ease with which authenticated users could launch attacks.