Vulnerability · Published Jun 19, 2025 · Assigned by VulDB

CVE-2025-6282xlang-ai OpenAgents file.py create_upload_file path traversal

Medium 5.5

In plain English

A medium-severity path traversal in OpenAgents from xlang-ai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.6%top 49.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in xlang-ai OpenAgents up to ff2e46440699af1324eb25655b622c4a131265bb and classified as critical. Affected by this issue is the function create_upload_file of the file backend/api/file.py. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The reported GitHub issue was closed automatically with the label "not planned" by a bot.

Affected products (as reported)

Vendor	Product	Versions
xlang-ai	OpenAgents	ff2e46440699af1324eb25655b622c4a131265bb

Weakness: CWE-22 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-313286 | xlang-ai OpenAgents file.py create_upload_file path traversal vdb-entry, technical-description
VDB-313286 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #593616 | xlang-ai OpenAgents commit ff2e464 Path Traversal third-party-advisory
https://github.com/xlang-ai/OpenAgents/issues/141 exploit, issue-tracking