Path Traversal in Xlang Openagents
CVE-2025-6282
A vulnerability was found in xlang-ai OpenAgents up to ff2e46440699af1324eb25655b622c4a131265bb and classified as critical. Affected by this issue is the function create_upload_file of the file backend/api/file.py. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The reported GitHub issue was closed automatically with the label "not planned" by a bot.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.006 (46.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
Affected products
- Xlang Openagents
- Xlang-ai Openagents — versions ff2e46440699af1324eb25655b622c4a131265bb
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cna@vuldb.com (technical-description, VDB Entry, Third Party Advisory, vdb-entry)
- cna@vuldb.com (signature, Permissions Required, permissions-required, VDB Entry)
- cna@vuldb.com (VDB Entry, Third Party Advisory, third-party-advisory)
- cna@vuldb.com (issue-tracking, Exploit, exploit, Issue Tracking)
Frequently asked questions
- What is CVE-2025-6282?
- CVE-2025-6282 is a medium-severity vulnerability in Xlang Openagents, classified under Path Traversal. CVSS score: 5.5/10. Published 2025-06-19.
- How severe is CVE-2025-6282?
- Medium severity. CVSS v3 base score is 5.5 out of 10.
- Is CVE-2025-6282 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.