PT-2025-26247 · Xataio · Xata Agent

Arashimuo · Published 2025-06-19 · Updated 2025-09-30 · CVE-2025-6283

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions xataio Xata Agent versions up to 0.3.0

Description A path traversal issue has been identified, affecting the GET function of the file apps/dbagent/src/app/api/evals/route.ts. The manipulation of the argument passed leads to this issue.

Recommendations For xataio Xata Agent versions up to 0.3.0, upgrade to version 0.3.1 to address this issue.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-6283

Affected Products

Xata Agent

References · 14

• 🔥 https://github.com/xataio/agent/issues/179 · Exploit
• https://github.com/xataio/agent/pull/191 · Patch
• https://github.com/xataio/agent/commit/03f27055e0cf5d4fa7e874d34ce8c74c7b9086cc · Patch
• https://github.com/xataio/agent/releases/tag/v0.3.1 · Patch
• https://osv.dev/vulnerability/CVE-2025-6283 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6283 · Security Note
• https://twitter.com/VulmonFeeds/status/1935847148098027995 · Twitter Post
• https://vuldb.com/?ctiid.313287 · Note
• https://twitter.com/CVEnew/status/1936508747947610454 · Twitter Post
• https://vuldb.com/?submit.593627 · Note
• https://t.me/cvenotify/126188 · Telegram Post
• https://vuldb.com/?id.313287 · Note
• https://t.me/cveNotify/136986 · Telegram Post
• https://t.me/cvetracker/26596 · Telegram Post