@google/adk: Path Traversal in FileArtifactService allows unauthenticated arbitrary file read/write via crafted userId/sessionId

Impact

FileArtifactService built filesystem paths from the userId and sessionId values using path.join() without validation or a containment check. When an application uses FileArtifactService (for example through a file:// artifact service URI) and exposes the ADK API server, a remote unauthenticated client can supply path traversal sequences (raw ../ or percent-encoded ..%2F) in the userId or sessionId route parameters and make the service resolve artifact paths outside the intended storage root (users/<userId>/sessions/<sessionId>/artifacts).

Example request:

GET /apps/{app}/users/alice/sessions/..%2F..%2F..%2F..%2Fsome%2Fdir/artifacts/{name}

• Confidentiality: artifacts stored under directories outside the storage root, including other users' or sessions' artifacts, can be read if they follow the artifact directory layout (<name>/versions/<n>/...) and are readable by the Node.js process.
• Integrity: when an agent tool saves artifacts (saveArtifact), an attacker who controls the userId or sessionId of a run can cause artifact files to be written outside the storage root.

Applications that use the default in-memory artifact service are not affected.

Patches

Fixed in @google/adk 0.6.0 (google/adk-js#210). The fix adds an allow-list check for userId and sessionId (alphanumerics, _, -, ., @; no path separators, percent-encoding, null bytes or leading .) and a post-resolution check that the resulting path stays inside the storage root. Versions < 0.6.0 are affected. Upgrade to 0.6.0 or later.

Workarounds

If upgrading is not possible:

• Do not use FileArtifactService; use another artifact service.
• Do not expose the ADK API server to untrusted clients; put it behind authentication.
• Validate userId and sessionId at a proxy or middleware layer, rejecting anything outside ^[A-Za-z0-9_@-][A-Za-z0-9_.@-]{0,255}$.
• Run the Node.js process with a least-privilege account and a filesystem limited to the artifact directory.

Reported by

Gouri Sankar A (@g0w6y)