A path traversal in the google-adk builder endpoint lets an unauthenticated remote attacker read arbitrary files via a crafted file_path query parameter. Affected: Google Cloud Agent Development Kit (ADK) for Python >= 1.9.0, < 1.22.0 (1.9.0–1.21.0). Impact is high confidentiality loss through file disclosure. Upgrade to 1.22.0+.