CVE-2026-58499 Details

A path traversal vulnerability has been identified in EverOS, a memory runtime for agents, in versions prior to 1.0.1. The issue arises in the POST /api/v1/memory/add ingestion endpoint, where the sender_id field was not properly validated as a path-safe identifier. Unlike the app_id and project_id fields, which include path-safety validation, sender_id allowed ../ sequences to escape the designated memory root. This flaw enabled an unauthenticated user to create or overwrite Markdown files in locations writable by the server process, with content partially influenced by the attacker.

Users are advised to upgrade to EverOS version 1.0.1, which addresses the vulnerability by implementing path-safe validation for the sender_id and adding a containment check in the Markdown writer to prevent writes outside the memory root.