Do Unauthenticated Attackers Leverage ADK TypeScript Flaw to Read Files?

A critical path traversal flaw in Google ADK TypeScript enables remote attackers to access files outside the designated artifact storage directory. The National Vulnerability Database rates CVE-2026-105772 as critical with a CVSS score of 9.1. This weakness exists in the FileArtifactService component. It allows unauthenticated users to read sensitive files or write new ones if the service is exposed.

The issue arises when developers enable the non-default FileArtifactService. Attackers can manipulate the userId or sessionId parameters to escape the intended storage root. They use crafted relative paths or percent-encoded sequences like ..%2F to achieve this. This behavior matches the CWE-22 path traversal weakness classification.

Which versions of Google ADK are vulnerable?

The flaw impacts Google ADK TypeScript packages, specifically the @google/adk module, in versions 0.4.0 up to but not including 0.6.0. Any application running these specific versions with the FileArtifactService enabled is at risk. The vulnerability does not affect the default configuration. If an application uses the InMemoryArtifactService, it remains unaffected by this specific path traversal issue. Developers must verify their installed version to determine exposure.

How does the attack mechanism work?

Attackers exploit the way the FileArtifactService handles user input in the userId or sessionId parameters. By injecting crafted relative paths such as ../ or encoded variants like ..%2F, they can traverse the directory structure. This allows them to read files that match the artifact directory layout outside the intended root. They can also write files if an agent tool invokes the saveArtifact function. The attack requires no authentication. It succeeds when the ADK API server is exposed to the attacker.

What is the impact of this vulnerability?

Successful exploitation allows an attacker to read files matching the artifact directory layout outside the intended artifact storage root. They can also write files outside the intended root when an agent tool invokes saveArtifact. The severity is high due to the lack of authentication requirements. The National Vulnerability Database lists the CVSS score as 9.1, indicating a critical risk level. Organizations should assess their exposure immediately.

What is the recommended fix?

Google has released version 0.6.0 of the @google/adk package to address this issue. Developers should upgrade to version 0.6.0 or later to mitigate the risk. The update resolves the path traversal vulnerability in the FileArtifactService. Applications using the default InMemoryArtifactService do not need an immediate update for this specific flaw. However, upgrading is generally recommended for security best practices. Verify the version after updating to ensure the patch is applied.

What analysts watch for

Teams usually monitor for unusual file access patterns in API logs. Look for requests containing encoded path sequences like %2F or %2E in user or session parameters. Check for attempts to access files outside the expected artifact directory. Analysts should review server logs for successful reads or writes triggered by these crafted inputs. Examine the configuration of artifact services to identify if non-default storage options are enabled. Monitor for any unauthorized file creation or modification events.

Background: CVSS score

The CVSS score provides a standardized number to rank vulnerability severity. Small teams should use it to prioritize patches, but must adjust for business context. A high score does not always mean immediate danger if the affected component is isolated or unused.

Read the full guide: CVSS Scores Explained: What Small Teams Must Know

What to do and how to stay safe: Google

• Audit your applications to confirm the installed version of @google/adk.
• Upgrade to version 0.6.0 or later if you are using a vulnerable version.
• Review server logs for suspicious path traversal attempts or encoded characters.
• Ensure your ADK API server is not unnecessarily exposed to untrusted networks.

Step-by-step guide: Patch Management: Why Updates Fail and How to Fix It

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is the default artifact service affected by this vulnerability?

No, applications using the default InMemoryArtifactService are unaffected by CVE-2026-105772.

What parameters do attackers exploit to trigger this flaw?

Attackers exploit crafted inputs in the userId or sessionId parameters to traverse directories.

What is the CVSS score for this vulnerability?

The National Vulnerability Database assigns a CVSS score of 9.1, rating it as critical.