PT-2025-26246 · Unknown · Xlang-Ai Openagents

Arashimuo · Published 2025-06-19 · Updated 2025-09-30 · CVE-2025-6282

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions xlang-ai OpenAgents versions up to ff2e46440699af1324eb25655b622c4a131265bb

Description A critical issue was found in the create upload file function of the backend/api/file.py file, leading to path traversal. The exploit has been disclosed to the public and may be used. The product uses continuous delivery with rolling releases, and therefore, no version details of affected or updated releases are available.

Recommendations As a temporary workaround, consider disabling the create upload file function until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-6282

Affected Products

Xlang-Ai Openagents

References · 10

• 🔥 https://github.com/xlang-ai/OpenAgents/issues/141 · Exploit
• https://osv.dev/vulnerability/CVE-2025-6282 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6282 · Security Note
• https://t.me/cveNotify/136985 · Telegram Post
• https://vuldb.com/?id.313286 · Note
• https://twitter.com/CVEnew/status/1936508748757094541 · Twitter Post
• https://vuldb.com/?submit.593616 · Note
• https://t.me/cvetracker/26595 · Telegram Post
• https://vuldb.com/?ctiid.313286 · Note
• https://t.me/cvenotify/126187 · Telegram Post