CVE-2025-6282

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in xlang-ai OpenAgents up to ff2e46440699af1324eb25655b622c4a131265bb and classified as critical. Affected by this issue is the function create_upload_file of the file backend/api/file.py. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The reported GitHub issue was closed automatically with the label "not planned" by a bot.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Jun 19, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-628204.9Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network.CVE-2025-628219.1Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntry_GetDataSize can return success while leaving t CVE-2025-628264.3An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet F CVE-2025-62837.5A vulnerability was found in xataio Xata Agent up to 0.3.0. It has been classified as problematic. This affects the function GET of the file CVE-2025-62844.3A vulnerability was found in PHPGurukul Car Rental Portal 3.0. It has been declared as problematic. This vulnerability affects unknown code.CVE-2025-628403.3A generation of error message containing sensitive information vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an att CVE-2025-628427.8An external control of file name or path vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local netw CVE-2025-628436.8An improper restriction of communication channel to intended endpoints vulnerability has been reported to affect QHora. If an attacker gains CVE-2025-628445.5A weak authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the CVE-2025-628456.7An improper neutralization of escape, meta, or control sequences vulnerability has been reported to affect QHora. If a local attacker gains CVE-2025-628466.7An SQL injection vulnerability has been reported to affect QHora. If a local attacker gains an administrator account, they can then exploit CVE-2025-628477.5An improper neutralization of argument delimiters in a command vulnerability has been reported to affect several QNAP operating system versi