CyberRota Analysis
AI-GeneratedOpenBMB XAgent versions 1.0.0 and earlier are susceptible to a path traversal vulnerability in the file() function, allowing attackers to manipulate the "filename" input parameter to access unauthorized files on the server. This flaw can lead to the disclosure of sensitive information, posing a significant risk to data confidentiality. Organizations using affected versions should prioritize patching this vulnerability to mitigate potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenBMB XAgent v1.0.0 and before is vulnerable to path traversal in the file() function in XAgent/XAgentServer/application/routers/workspace.py. The input parameter “filename” is user-controllable and is concatenated into the file path to be read without proper validation, leading to a directory traversal vulnerability that may result in sensitive information disclosure.