ByteDance DeerFlow before commit 2176b2b contains a path traversal and arbitrary file write vulnerability in bootstrap-mode custom-agent creation where the agen…

ByteDance DeerFlow contains a path traversal and arbitrary file write vulnerability in bootstrap-mode custom-agent creation. The vulnerability exists before commit 2176b2b where agent name validation is bypassed. Attackers can supply traversal-style values or absolute paths as agent names to influence directory creation. This allows writing files outside the intended custom-agent directory. The vulnerability can potentially achieve arbitrary file write on the system subject to filesystem permissions. The issue affects the custom-agent creation functionality specifically.