GHSA-3pw3-v88x-xj24: Paperclip Arbitrary File Read Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-3pw3-v88x-xj24",
  "modified" : "2026-04-16T22:45:14Z",
  "published" : "2026-04-16T22:45:14Z",
  "aliases" : [ ],
  "summary" : "Paperclip: Arbitrary File Read via Agent-Controlled adapterConfig.instructionsFilePath",
  "details" : "### Summary\nPaperclip contains an arbitrary file read vulnerability that allows an attacker with an Agent API key to read files from the Paperclip server host filesystem.\nThe vulnerability occurs because agents are allowed to modify their own adapterConfig through the /agents/:id API endpoint.\nThe configuration field adapterConfig.instructionsFilePath is later read directly by the server runtime using fs.readFile().\nBecause no validation or path restriction is applied, an attacker can supply an arbitrary filesystem path.\nThe Paperclip server then attempts to read that path from the host filesystem during agent execution.\nThis breaks the intended trust boundary between agent runtime configuration and server host filesystem access, allowing a compromised or malicious agent to access sensitive files on the host system.\n\n### Details\n#### Root Cause\nNo path normalization, allowlist, or workspace boundary validation is applied before the filesystem read occurs.\nAgent configuration can be modified through the API endpoint:\n```\nPATCH /api/agents/:id\n```\nThe validation schema allows arbitrary configuration fields inside adapterConfig.\nFile:\n```\npackages/shared/src/validators/agent.ts\n```\nSchema fragment:\n```\nadapterConfig: z.record(z.unknown())\n```\nBecause of this schema, attackers can inject arbitrary configuration values, including:\n```\nadapterConfig.instructionsFilePath\n```\nDuring agent execution, the server runtime reads this path directly from the host filesystem using fs.readFile().\nRelevant code path:\n```\npackages/adapters/claude-local/src/server/execute.ts\n```\nExecution flow:\n```\nadapterConfig.instructionsFilePath\n        ↓\nexecute()\n        ↓\nfs.readFile(instructionsFilePath)\n        ↓\nfile content loaded into runtime\n```\nVulnerable logic:\n```\nconst instructionsContent = await fs.readFile(instructionsFilePath, \"utf-8\");\n```\nBecause the value originates from attacker-controlled configuration and no validation or sandboxing is applied, this becomes a direct host filesystem read primitive.\n\n#### Affected Files\nPrimary vulnerable file:\n```\npackages/adapters/claude-local/src/server/execute.ts\n```\nRelevant function:\n```\nexecute()\n```\nSensitive operation:\n```\nfs.readFile(instructionsFilePath)\n```\nConfiguration source:\n```\nPATCH /api/agents/:id\n```\nValidation logic:\n```\npackages/shared/src/validators/agent.ts\n```\n\n#### Attacker Model\nRequired privileges\nAttacker requires:\n```\nAgent API key\n```\nAgent credentials are intended for automation and integration with external runtimes.\nThese credentials are commonly used by:\n```\nagent runtime environments\nthird-party integrations\nautomation pipelines\n```\nAgent credentials are not intended to grant direct access to the server host filesystem.\nNo board or administrator privileges are required.\n\n#### Attacker Chain\nComplete exploit chain:\n```\nAttacker obtains Agent API key\n        ↓\nPATCH /api/agents/:id\n        ↓\nInject adapterConfig.instructionsFilePath\n        ↓\nPOST /api/agents/:id/wakeup\n        ↓\nServer executes agent run\n        ↓\nexecute.ts\n        ↓\nfs.readFile(attacker_path)\n        ↓\nServer reads host filesystem path\n```\nThis allows an attacker to read arbitrary files accessible to the Paperclip server process.\n\n#### Trust Boundary Violation\nPaperclip’s architecture assumes the following separation:\n```\nAgent runtime\n        ↓\nPaperclip orchestration layer\n        ↓\nServer host filesystem\n\nAgents should only interact with repositories and workflows through the orchestration layer.\n\nHowever, because agent-controlled configuration is passed directly into fs.readFile, the boundary collapses:\n\nAgent configuration\n        ↓\nServer filesystem access\n```\nThis allows an agent to access files outside its intended permission scope.\n\n#### Why This Is a Vulnerability (Not Expected Behavior)\nThe instructionsFilePath configuration appears intended for trusted operators configuring agent runtime behavior.\nHowever, the current API design allows agents themselves to modify this configuration through the agent API.\nBecause agent credentials may be exposed to external systems or runtime environments, allowing them to control server filesystem paths introduces a security vulnerability.\nTherefore:\n```\nOperator-controlled configuration → expected feature\nAgent-controlled configuration → arbitrary file read vulnerability\n```\nThe issue arises from insufficient separation between configuration authority and filesystem access authority.\n\n### PoC\nThe following PoC demonstrates that the server attempts to read an attacker-controlled filesystem path.\nTo avoid accessing sensitive data, the PoC uses a non-existent path.\n#### Step 1 — Setup Environment\nRun server:\n```\n$env:SHELL = \"C:\\Program Files\\Git\\bin\\sh.exe\"\nnpx paperclipai onboard --yes\n```\nLogin Claude:\n```\nclaude\n/login\n```\n#### Step 2 — Obtain Agent API key\nCreate an agent via the UI or CLI and obtain its API key.\nExample:\n<img width=\"1475\" height=\"710\" alt=\"image\" src=\"https://github.com/user-attachments/assets/fcc0dfe9-1271-4eed-af0a-7dd83dfa9ad4\" />\n\n#### Step 3 — Identify agent ID\n```\nGET /api/agents/me\n```\n<img width=\"824\" height=\"196\" alt=\"image\" src=\"https://github.com/user-attachments/assets/af4a16bb-9bff-485d-af23-4a85d31486fc\" />\n\n#### Step 4 — Inject malicious configuration\n```\nPATCH /api/agents/{agentId}\n```\nPayload example:\n```powershell\n{\n  \"adapterConfig\": {\n    \"instructionsFilePath\": \"C:\\\\definitely-does-not-exist-paperclip-poc.txt\"\n  }\n}\n```\nExample PowerShell payload:\n```powershell\n$patchBody = @{\n  adapterConfig = @{\n    instructionsFilePath = \"C:\\definitely-does-not-exist-paperclip-poc.txt\"\n  }\n} | ConvertTo-Json -Depth 10\n```\n<img width=\"1891\" height=\"963\" alt=\"image\" src=\"https://github.com/user-attachments/assets/1a8c41b4-c053-4498-8bf5-ce41c7dfa1b5\" />\n\nStep 5 — Trigger execution\n```\nPOST /api/agents/{agentId}/wakeup\n```\n<img width=\"927\" height=\"376\" alt=\"image\" src=\"https://github.com/user-attachments/assets/d6107b64-1b5e-493c-9a66-45a4713260b5\" />\n\n#### Step 6 — Observe server log\nServer log shows:\n```\nENOENT: no such file or directory, open 'C:\\definitely-does-not-exist-paperclip-poc.txt'\n    at async Object.readFile\n    at async Object.execute (.../adapter-claude-local/dist/server/execute.js)\n```\nThis confirms the server attempted to read an attacker-controlled filesystem path.\n<img width=\"1916\" height=\"166\" alt=\"image\" src=\"https://github.com/user-attachments/assets/2470438a-bf5a-4f6f-848c-b134d3f0cc3f\" />\n\n### Impact\nSuccessful exploitation allows attackers to read sensitive files accessible to the Paperclip server process.\nExamples of potentially exposed data include:\n```\nenvironment configuration (.env)\nSSH private keys\ndatabase credentials\nAPI tokens\nCI secrets\n```\nPossible attacker actions:\n```\nexfiltrate secrets\naccess private repositories\nsteal infrastructure credentials\npivot into connected services\n```\nBecause Paperclip orchestrates repositories, agents, and automation tasks, disclosure of such secrets may lead to compromise of the broader deployment environment.\n\n### Recommended Fix\n#### Restrict configuration authority\nAgents should not be allowed to modify filesystem-sensitive configuration fields.\nExample mitigation:\n```\nadapterConfig.instructionsFilePath\n```\nshould only be configurable by board/admin actors.\n\n#### Path validation\nRestrict file access to a safe directory such as:\n```\nworkspace/\nagent-config/\n```\nReject:\n```\nabsolute paths\nsystem directories\npaths containing \"..\"\n```\n\n#### Avoid direct filesystem reads from configuration\nInstead of:\n```\nfs.readFile(user_supplied_path)\n```\nuse:\n```\nreadFile(workspaceSafePath)\n```\nExample guard\n```ts\nif (\n  request.auth?.principal === \"agent\" &&\n  body?.adapterConfig?.instructionsFilePath\n) {\n  throw new Error(\n    \"Agents are not permitted to configure instructionsFilePath\"\n  );\n}\n```\n\n### Security Impact Statement\nAn authenticated attacker with an Agent API key can modify their agent configuration to inject an arbitrary filesystem path into adapterConfig.instructionsFilePath.\nThe Paperclip server reads this path during agent execution via fs.readFile, allowing the attacker to access files on the server host filesystem.\n\n### Disclosure\nThis vulnerability was discovered during security research on the Paperclip orchestration runtime and is reported privately to allow maintainers to patch the issue before public disclosure.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@paperclipai/shared"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2026.416.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/paperclipai/paperclip/security/advisories/GHSA-3pw3-v88x-xj24"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/paperclipai/paperclip"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-73" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-16T22:45:14Z",
    "nvd_published_at" : null
  }
}