CVE-2026-105772 | Google ADK up to 0.5.x FileArtifactService saveArtifact userId/sessionId path traversal

October 20, 2026 Yanac

A vulnerability was found in Google ADK up to 0.5.x. It has been rated as critical. This affects the function saveArtifact of the component FileArtifactService. This manipulation of the argument userId/sessionId causes path traversal.

This vulnerability is tracked as CVE-2026-105772. The attack is possible to be carried out remotely. No exploit exists.

Upgrading the affected component is advised.VulDB Recent EntriesRead More