CVE-2026-3954

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A weakness has been identified in OpenBMB XAgent 1.0.0. Affected by this vulnerability is the function workspace of the file XAgentServer/application/routers/workspace.py. This manipulation of the argument file_name causes path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Mar 11, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-395406.5Subscriber Cross Site Scripting (XSS) in Shipment Tracker for Woocommerce <= 1.5.3.2 versions.CVE-2026-395415.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Hydra Booking hydra-booking a CVE-2026-395425.3Insertion of Sensitive Information Into Sent Data vulnerability in Doofinder Doofinder for WooCommerce doofinder-for-woocommerce allows Retr CVE-2026-395435.3Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This CVE-2026-395447.5Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themeStek LabtechCO CVE-2026-395458.1Unauthenticated PHP Object Injection in Zermatt <= 1.6.1 versions.CVE-2026-395467.6Subscriber Privilege Escalation in MultiLoca <= 4.2.15 versions.CVE-2026-395478.1Unauthenticated Local File Inclusion in Getaway < 1.8 versions.CVE-2026-395487.1Unauthenticated Cross Site Scripting (XSS) in MagOne <= 9.0 versions.CVE-2026-395498.1Unauthenticated Local File Inclusion in Aperitif <= 1.5 versions.CVE-2026-39556.3A security vulnerability has been detected in elecV2P up to 3.8.3. Affected by this issue is the function runJSFile of the file source-code/CVE-2026-395508.1Deserialization of Untrusted Data vulnerability in Elated-Themes Aperitif allows Object Injection. This issue affects Aperitif: from n/a th