CVE-2025-6282

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in xlang-ai OpenAgents up to ff2e46440699af1324eb25655b622c4a131265bb and classified as critical. Affected by this issue is the function create_upload_file of the file backend/api/file.py. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The reported GitHub issue was closed automatically with the label "not planned" by a bot.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
xlang-ai	OpenAgents	ff2e46440699af1324eb25655b622c4a131265bb

References

https://github.com/xlang-ai/OpenAgents/issues/141Exploit, Issue Tracking
https://vuldb.com/?ctiid.313286Permissions Required, VDB Entry
https://vuldb.com/?id.313286Third Party Advisory, VDB Entry
https://vuldb.com/?submit.593616Third Party Advisory, VDB Entry
https://github.com/xlang-ai/OpenAgents/issues/141Exploit, Issue Tracking

Timeline

Published: Jun 19, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-628204.9Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network.CVE-2025-628219.1Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntry_GetDataSize can return success while leaving t CVE-2025-628264.3An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet F CVE-2025-62837.5A vulnerability was found in xataio Xata Agent up to 0.3.0. It has been classified as problematic. This affects the function GET of the file CVE-2025-628398.7An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploit CVE-2025-62844.3A vulnerability was found in PHPGurukul Car Rental Portal 3.0. It has been declared as problematic. This vulnerability affects unknown code.CVE-2025-628403.3A generation of error message containing sensitive information vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an att CVE-2025-628418.7An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploit CVE-2025-628427.8An external control of file name or path vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local netw CVE-2025-628436.8An improper restriction of communication channel to intended endpoints vulnerability has been reported to affect QHora. If an attacker gains CVE-2025-628445.5A weak authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the CVE-2025-628456.7An improper neutralization of escape, meta, or control sequences vulnerability has been reported to affect QHora. If a local attacker gains