CVE-2026-75482 SWE-agent CVE debrief

Who should care

Defenders and administrators of SWE-agent trajectory inspector should assess exposure and verify version, as unauthenticated network clients can read files outside the intended directory, potentially disclosing repository contents, command output, and secrets/API keys.

Why it matters

CVE-2026-75482 is a path traversal vulnerability in SWE-agent's trajectory inspector that allows unauthenticated network clients to read files outside the intended directory, potentially disclosing sensitive information. Defenders and administrators should assess exposure and verify version to prioritize remediation.

• Potential disclosure of repository contents, command output, and secrets/API keys
• Unauthenticated network clients can read files outside the intended directory
• Path traversal sequences can be used to bypass built-in path sanitization

Technical summary

The SWE-agent trajectory inspector, confirmed in v1.1.0, is an HTTP server that joins request paths to the trajectory directory in its /trajectory/ handler without rejecting parent-directory ('..') references, bypassing the built-in path sanitization. An unauthenticated network client can use path traversal sequences to read files outside the intended directory, constrained to JSON files shaped like a trajectory.

Defensive priority

Assess exposure of SWE-agent trajectory inspector, verify version, and apply remediation if available.

Recommended defensive actions

• Assess exposure of SWE-agent trajectory inspector in your environment
• Verify the version of SWE-agent trajectory inspector and apply remediation if available
• Monitor for suspicious activity on the affected system
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the path traversal vulnerability in SWE-agent's trajectory inspector. The inspector is an HTTP server that joins request paths to the trajectory directory without rejecting parent-directory references, allowing unauthenticated network clients to read files outside the intended directory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.