CVE-2026-72713
XAgent contains a path traversal vulnerability in the workspace file endpoint that allows self-registered or default-credential users to read arbitrary files o…
Impact
XAgent contains a path traversal vulnerability in the workspace file endpoint that allows self-registered or default-credential users to read arbitrary files on the host by supplying parent-directory segments in the `file_name` form field with no path containment check. Attackers can register an account without email verification, then submit crafted `file_name` values such as parent-directory traversal sequences to the `/workspace/file` handler to read host files including application secrets, database credentials, and system files outside the Docker sandbox.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/OpenBMB/XAgent
- https://github.com/OpenBMB/XAgent/commit/26f2b6edc75127af524f027c022b382967178e3a
- https://github.com/OpenBMB/XAgent/issues/429
- https://github.com/OpenBMB/XAgent/pull/432
- https://www.vulncheck.com/advisories/xagent-path-traversal-arbitrary-file-read-via-workspace-file