CVE-2026-4308
frdel/agent0ai agent-zero document_query.py handle_pdf_document server-side request forgery
CVSS Score
6.3
EPSS Score
0.0%
EPSS Percentile
0th
A weakness has been identified in frdel/agent0ai agent-zero 0.9.7. This affects the function handle_pdf_document of the file python/helpers/document_query.py. This manipulation causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
| CWE | CWE-918 |
| Vendor | frdel |
| Product | agent-zero |
| Published | Mar 17, 2026 |
| Last Updated | Mar 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for frdel agent-zero
Be the first to know when new medium vulnerabilities affecting frdel agent-zero are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
frdel / agent-zero
0.9.7
agent0ai / agent-zero
0.9.7
References
vuldb.com: https://vuldb.com/?id.351338 vuldb.com: https://vuldb.com/?ctiid.351338 vuldb.com: https://vuldb.com/?submit.773950 gist.github.com: https://gist.github.com/YLChen-007/c99c44aa019266a72636757308d43989 gist.github.com: https://gist.github.com/YLChen-007/c99c44aa019266a72636757308d43989#poc
Credits
🔍 Eric-y (VulDB User) VulDB