PT-2026-3021 · Omnispace · Omnispace Agora Project

Published 2026-01-15 · Updated 2026-01-21 · CVE-2025-67076

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Omnispace Agora Project versions prior to 25.10

Description A directory traversal issue exists in Omnispace Agora Project. This allows unauthenticated attackers to read files on the system through the misc controller and the ExternalGetFile action. Only files with an extension can be read.

Recommendations Update to version 25.10 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-67076

Affected Products

Omnispace Agora Project

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-67076 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67076 · Vendor Advisory
• https://twitter.com/CVEnew/status/2012490386007097687 · Twitter Post
• https://agora-project.net · Note
• https://twitter.com/transilienceai/status/2012729485003567284 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2011853936890683768 · Twitter Post
• https://helx.io/blog/advisory-agora-project · Note
• https://t.me/cveNotify/149384 · Telegram Post