Path Traversal in Xata Agent
CVE-2025-6283
A vulnerability was found in xataio Xata Agent up to 0.3.0. It has been classified as problematic. This affects the function GET of the file apps/dbagent/src/app/api/evals/route.ts. The manipulation of the argument passed leads to path traversal. Upgrading to version 0.3.1 is able to address this issue. The patch is named 03f27055e0cf5d4fa7e874d34ce8c74c7b9086cc. It is recommended to upgrade the affected component.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.006 (45.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.5 (Low). Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Xata Agent
- Xataio Xata Agent — versions 0.1, 0.2, 0.3.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cna@vuldb.com (technical-description, VDB Entry, Third Party Advisory, vdb-entry)
- cna@vuldb.com (signature, Permissions Required, permissions-required, VDB Entry)
- cna@vuldb.com (VDB Entry, Third Party Advisory, third-party-advisory)
- cna@vuldb.com (issue-tracking, Exploit, Patch, Issue Tracking)
- cna@vuldb.com (issue-tracking, Patch, Issue Tracking)
- cna@vuldb.com (Patch, patch)
- cna@vuldb.com (Release Notes, patch)
Frequently asked questions
- What is CVE-2025-6283?
- CVE-2025-6283 is a low-severity vulnerability in Xata Agent, classified under Path Traversal. CVSS score: 3.5/10. Published 2025-06-19.
- How severe is CVE-2025-6283?
- Low severity. CVSS v3 base score is 3.5 out of 10.
- Is CVE-2025-6283 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.