CVE-2026-50181

Affected versions of the Langroid package are vulnerable to Path Traversal due to insufficient path validation in file operations. The `ReadFileTool` and `WriteFileTool` components fail to enforce that user-supplied `file_path` values remain within the configured `curr_dir`, allowing traversal sequences like `../` to access files outside the intended directory. An attacker can exploit this vulnerability by supplying crafted file paths to read or write files beyond the restricted directory, potentially exposing sensitive data or altering unauthorized files.