What happened
A path-traversal flaw in the agent workflow executor's file-write step allows a crafted step path to escape the intended working directory and write to arbitrary filesystem locations.
Why it matters
Arbitrary file write from an agent workflow step can lead to code execution or configuration tampering, though the narrow single-project deployment keeps blast radius limited.
Attack vector
The executeStep file-step implementation passes a user-controlled step.path value through path.resolve with process.cwd() without validating the result stays within an intended directory, enabling path traversal to write files outside the intended workflow directory.
Affected systems
AI Agent Automation < 0.9.1
Mitigation
Upgrade to AI Agent Automation 0.9.1 or later.