Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ByteDance DeerFlow before commit 2176b2b contains a path traversal and arbitrary file write vulnerability in bootstrap-mode custom-agent creation where the agent name validation is bypassed. Attackers can supply traversal-style values or absolute paths as the agent name to influence directory creation and write files outside the intended custom-agent directory, potentially achieving arbitrary file write on the system subject to filesystem permissions.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-40518 ByteDance DeerFlow before commit 2176b2b contains a path traversal and arbitrary file write vulnerability in bootstrap-mode custom-agent creation where the agent name… https://www.cve.org/CVERecord?id=CVE-2026-40518
Post summary
A tweet notes CVE‑2026‑40518, a path traversal / arbitrary file write bug in ByteDance DeerFlow before commit 2176b2b, but offers no additional context on exploitation, PoC, or remediation.
CVE-2026-40518 Path Traversal and Arbitrary File Write in ByteDance Deer... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40518 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The tweet announces CVE-2026-40518, links to its details, and notes it involves path traversal and arbitrary file write, but gives no further technical depth, exploit, patch, or activity information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | bytedance | deerflow | 2.0-m0 | - | - |