Vulnerability · Published Aug 21, 2025 · Assigned by mitre

CVE-2025-55523

Low 3.5

In plain English

A low-severity path traversal in the affected software. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)1.1%top 33.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Nuclei

Official description

An issue in the component /api/download_work_dir_file.py of Agent-Zero v0.8.* allows attackers to execute a directory traversal.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-22 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/frdel/agent-zero/blob/v0.8.7/python/api/download_work_dir_file.py
https://www.cve.org/CVERecord?id=CVE-2025-6166
https://github.com/agent0ai/agent-zero/issues/687