From e85d437bb2e0c7badf5d29a649289b2927e1b0f6 Mon Sep 17 00:00:00 2001 From: Zamil Majdy Date: Wed, 11 Feb 2026 06:26:48 +0400 Subject: [PATCH] fix(backend/chat): Sanitize session_id in SDK cwd path to prevent path traversal --- .../backend/backend/api/features/chat/sdk/service.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/autogpt_platform/backend/backend/api/features/chat/sdk/service.py b/autogpt_platform/backend/backend/api/features/chat/sdk/service.py index d28db3add8..9681c86065 100644 --- a/autogpt_platform/backend/backend/api/features/chat/sdk/service.py +++ b/autogpt_platform/backend/backend/api/features/chat/sdk/service.py @@ -238,8 +238,9 @@ async def stream_chat_completion_sdk( stream_completed = False # Use a session-specific temp dir to avoid cleanup race conditions - # between concurrent sessions. - sdk_cwd = f"/tmp/copilot-{session_id}" + # between concurrent sessions. Sanitize session_id to prevent path traversal. + safe_session_id = "".join(c for c in session_id if c.isalnum() or c == "-") + sdk_cwd = f"/tmp/copilot-{safe_session_id}" os.makedirs(sdk_cwd, exist_ok=True) try: