Vulnerability · Published Jun 19, 2025 · Assigned by VulDB

CVE-2025-6281OpenBMB XAgent community path traversal

Medium 5.5

In plain English

A medium-severity path traversal in XAgent from OpenBMB. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.5%top 59.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in OpenBMB XAgent up to 1.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /conv/community. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used.

Affected products (as reported)

Vendor	Product	Versions
OpenBMB	XAgent	1.0

Weakness: CWE-22 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-313285 | OpenBMB XAgent community path traversal vdb-entry
VDB-313285 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #593615 | OpenBMB XAgent <=v1.0.0 Path Traversal third-party-advisory
https://github.com/OpenBMB/XAgent/issues/415 exploit, issue-tracking