CVE-2026-5998 | zhayujie chatgpt-on-wechat CowAgent up to 2.0.4 API Memory Content Endpoint agent/memory/service.py dispatch filename path traversal (Issue 2734)

A vulnerability classified as critical has been found in zhayujie chatgpt-on-wechat CowAgent up to 2.0.4. This affects the function dispatch of the file agent/memory/service.py of the component API Memory Content Endpoint. This manipulation of the argument filename causes path traversal.

This vulnerability is handled as CVE-2026-5998. The attack can be initiated remotely. Additionally, an exploit exists.

It is recommended to upgrade the affected component.

The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.