CVE-2026-7784
Published: 05 May 2026
Description
A vulnerability has been found in RTGS2017 NagaAgent up to 5.1.0. This issue affects some unknown processing of the file apiserver/routes/extensions.py of the component Skills Endpoint. Such manipulation of the argument Name leads to path traversal. It is possible to…
more
launch the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.
Security SummaryAI
CVE-2026-7784 is a path traversal vulnerability (CWE-22) affecting RTGS2017 NagaAgent versions up to 5.1.0. The issue resides in the processing of the file apiserver/routes/extensions.py within the Skills Endpoint component, where manipulation of the "Name" argument enables traversal outside intended directories. Assigned a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), it was published on 2026-05-05.
Remote attackers require only network access to exploit this vulnerability, with no privileges, user interaction, or special conditions needed due to its low attack complexity. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially enabling unauthorized file reads, modifications, or disruptions within the affected agent's scope.
Advisories from VulDB and the project's GitHub repository indicate the vulnerability was reported early via issue #311, but the maintainers have not responded or issued patches as of the latest information. The exploit has been publicly disclosed and may be actively used by attackers.
Notable context includes the lack of vendor response, increasing risk for deployments of NagaAgent up to 5.1.0, with the GitHub repository serving as a primary reference for potential monitoring or manual fixes.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in unauthenticated network-accessible Skills Endpoint directly enables T1190 (exploit of public-facing app) and facilitates T1005 (arbitrary local file reads/modifications).