ByteDance DeerFlow Pfadüberschreitung und willkürliches Schreiben von Dateien über Bootstrap-Modus

The vulnerability stems from insufficient validation of the agent name during custom-agent creation in bootstrap mode. Attackers can craft malicious agent names containing traversal sequences (e.g., ../..) or absolute paths. This bypasses the intended directory restriction, allowing them to write files outside the designated custom-agent directory. The potential impact is significant, as an attacker could overwrite critical system files or inject malicious code, leading to complete system compromise, depending on the filesystem permissions of the DeerFlow process. Successful exploitation could enable remote code execution and persistent access to the affected system.

Organizations utilizing DeerFlow in their data processing pipelines, particularly those with bootstrap-mode custom-agent creation enabled, are at risk. Environments with less restrictive filesystem permissions for the DeerFlow process are especially vulnerable, as an attacker could leverage this vulnerability to gain broader system access. Users relying on DeerFlow for sensitive data processing should prioritize patching.

• python: Monitor DeerFlow process for unexpected file creation or modification outside of the intended custom-agent directory. Use os.walk() to recursively scan directories and identify suspicious files. • generic web: Examine DeerFlow logs for requests containing path traversal sequences in the agent name parameter. Use grep to search for patterns like ../ or absolute paths. • linux / server: Use lsof to identify processes accessing files outside the expected DeerFlow directory. lsof | grep deerflow

1. 2026-04-17Disclosure

   disclosure

1. Reserviert2026-04-13
2. Veröffentlicht2026-04-17
3. EPSS aktualisiert2026-04-25

The primary mitigation is to upgrade DeerFlow to version 2176b2bbfccfce25ceee08318813f96d843a13fd, which includes the necessary agent name validation fix. If immediate upgrading is not possible, consider implementing strict filesystem permissions on the custom-agent directory to limit the impact of potential file writes. Additionally, monitor DeerFlow logs for suspicious file creation attempts, particularly those involving traversal sequences or unexpected paths. WAF rules could be configured to block requests containing potentially malicious agent names, but this is not a substitute for patching.