File Write and Path Traversal Flaws Expose AGiXT and Bugsink to Server Compromise

Two application vulnerabilities have exposed AGiXT and Bugsink servers to filesystem-level attacks that can lead to full host compromise. In AGiXT, advisory GHSA-5gfj-64gh-mgmw describes an authenticated path traversal flaw in the Essential Abilities Extension, rated CVSS 8.8, that lets an attacker escape intended directories and access files with the permissions of the AGiXT process. The issue allows arbitrary read, write, and delete operations against sensitive targets including environment files, configuration data, database credentials, cryptographic keys, /etc/shadow, and .ssh/id_rsa, creating high risk to confidentiality, integrity, and availability.

A separate flaw tracked as CVE-2026-40162 affects Bugsink and enables authenticated arbitrary file write or overwrite within the application's runtime permissions, with a CVSS 7.1 rating. The weakness can be used to overwrite Python source files or module initialization scripts so attacker-controlled code executes on restart or when a new worker is spawned, effectively turning file access into remote code execution. Both disclosures warn that deployments running with elevated privileges or broad filesystem access face the greatest danger, including persistence through locations such as cron directories, .ssh/authorized_keys, or application package paths, as well as exposure of secrets, telemetry, and backend credentials.