CVE-2026-40518 is a path traversal flaw in ByteDance DeerFlow, scored CVSS 7.1. Custom agent creation in bootstrap mode can bypass name checks and write files outside the intended folder. The fix is commit 2176b2b, so update your checkout to a version that includes it.
What's affected
- Affected: DeerFlow before commit 2176b2b
- Fixed: commit 2176b2b (pull request 2274)
The record and VulnCheck describe the issue as a bypass of agent name validation in bootstrap mode. VulnCheck credits Chia Min Jun Lennon. No numbered release is named in the sources I read, so use the commit as your marker.
How to check if you're exposed
If you run DeerFlow from a git checkout, see whether the fix is included:
git merge-base --is-ancestor 2176b2b HEAD && echo "fix present" || echo "fix missing"
For a container image, check the commit or build date and compare it with the project repository. Look for unexpected files outside the custom agent directory, particularly in locations the service account can write to.
What to do now
- Update DeerFlow to a version that includes commit 2176b2b.
- Run the service as a low privilege user that cannot write outside its data directory.
- Restrict who can reach bootstrap mode and create agents.
- Check the filesystem for files created outside the agent directory.
Why it matters
The weakness is CWE-22, path traversal. A name that should be a simple folder label is accepted with traversal style values or an absolute path, and the program then creates directories and files at that location. The record says the result is subject to the filesystem permissions of the process.
That last point is the useful lever. Running the service with limited write access caps the damage from any file write bug. The CVSS vector requires low privileges. The record does not flag exploitation in the wild.
Quick check
Is there a version number to upgrade to?
The sources I read give a commit and a pull request, not a release. Use the commit as the marker.
Sources
Last reviewed: 19 October 2026.
