CVE-2026-58499
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedEverOS is a memory runtime for agents. Prior to 1.0.1, EverOS is vulnerable to path traversal in the POST /api/v1/memory/add ingestion endpoint because the per-message sender_id field was not validated as a path-safe identifier, unlike app_id and project_id. During user-memory extraction, sender_id is used as owner_id and joined into the filesystem path where the extracted episode is persisted as a Markdown file, so a sender_id containing ../ sequences could direct writes outside the configured memory root and allow an unauthenticated caller to create or overwrite .md files at locations writable by the server process with partially attacker-influenced content. This issue is fixed in version 1.0.1.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceEverOS prior to 1.0.1 has a path traversal vulnerability in the POST /api/v1/memory/add endpoint where the sender_id field is not validated as a path-safe identifier. Attackers can use ../ sequences in sender_id to write Markdown files outside the configured memory root, allowing unauthenticated arbitrary file creation with partially attacker-controlled content.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- Low
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Confirm EverOS is installed and get its versionCheck the installed EverOS version using package manager, binary version flag (e.g., --version), or API health endpoint. Compare against version 1.0.1.Affected if EverOS version is prior to 1.0.1
-
Verify the memory API endpoint is exposedAttempt to reach the POST /api/v1/memory/add endpoint. This may require checking the API documentation, service configuration, or making a test request to the endpoint.Affected if The /api/v1/memory/add endpoint is accessible (even if authentication is required, the path traversal check still applies to sender_id validation)
-
Check if the memory feature module is enabledInspect the EverOS configuration files or running service settings to determine if the memory functionality (memory module) is turned on.Affected if The memory feature is enabled in the EverOS configuration
-
Identify the configured memory root pathReview EverOS configuration files for the memory_root or storage path setting that defines where memory files are stored.Affected if A memory root path is configured (the vulnerability allows writing outside this root)
-
Test for path traversal in sender_id parameterSend a crafted POST request to /api/v1/memory/add with sender_id containing ../ sequences (e.g., sender_id=../../../test) and observe if files are created outside the memory root.Affected if Files are created outside the configured memory root directory
EverOS is affected if it is version prior to 1.0.1, the memory API endpoint is accessible, and the memory feature is enabled, allowing path traversal via sender_id parameter to write files outside the configured memory root.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedUpgrade EverOS to version 1.0.1 which includes proper validation of sender_id as a path-safe identifier.
1.0.1
- 1. Identify the currently running EverOS version by checking the container image tag, Helm chart version, or the running service version
- 2. Upgrade EverOS to version 1.0.1 or later by updating the deployment configuration (e.g., container image, Helm chart, or package manager)
- 3. Verify the fix by reviewing the patched code at the vendor commit (a10cdcd197747f371b7879a32c2cc3f77471e9c2) to confirm sender_id validation was added
- 4. After upgrade, test the /api/v1/memory/add endpoint by attempting to inject ../ sequences in the sender_id field and confirm the request is rejected or sanitized
- 5. Monitor logs for any path traversal attempts and ensure the memory root directory remains the only writable location
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation3.0 h
- Implementation4.0 h
- Testing3.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,408.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-58499 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-58499 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data