Login Request a demo
Medium severity · published Apr 10, 2026
CVE-2026-5998
zhayujie chatgpt-on-wechat CowAgent API Memory Content Endpoint service.py dispatch path traversal
5.3
CVSS
0.6%
EPSS
No
On KEV
Description
A flaw has been found in zhayujie chatgpt-on-wechat CowAgent up to 2.0.4. This affects the function dispatch of the file agent/memory/service.py of the component API Memory Content Endpoint. This manipulation of the argument filename causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used. Upgrading to version 2.0.5 mitigates this issue. Patch name: 174ee0cafc9e8e9d97a23c305418251485b8aa89. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
chatgpt-on-wechat CowAgent · zhayujie
2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4 · source: vendor
Affected product
CC
chatgpt-on-wechat CowAgent
zhayujie
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-5998
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-5998
github.com
https://github.com/zhayujie/chatgpt-on-wechat/commit/174ee0cafc9e8e9d97a23c305418251485b8aa89
github.com
https://github.com/zhayujie/chatgpt-on-wechat/issues/2734
github.com
https://github.com/zhayujie/chatgpt-on-wechat/issues/2734#issue-4178013778
github.com
https://github.com/zhayujie/chatgpt-on-wechat/releases/tag/2.0.5
vuldb.com
https://vuldb.com/submit/793558
vuldb.com
https://vuldb.com/vuln/356552
More from chatgpt-on-wechat CowAgent
7.3
CVE-2026-6129
zhayujie chatgpt-on-wechat CowAgent Agent Mode Service missing authentication
7.3
CVE-2026-6126
zhayujie chatgpt-on-wechat CowAgent Administrative HTTP Endpoint missing authentication
6.5
CVE-2026-14714
zhayujie chatgpt-on-wechat CowAgent wx Endpoint common.py verify_server missing authentication
6.3
CVE-2026-15628
zhayujie chatgpt-on-wechat CowAgent Vision Tool vision.py Vision._download_to_data_url server-side request forgery