CVE-2025-6282
Last modified
CVE-2025-6282 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. A vulnerability was found in xlang-ai OpenAgents up to ff2e46440699af1324eb25655b622c4a131265bb and classified as critical. Affected by this issue is the function create_upload_file of the file backend/api/file.py. EPSS estimates a 0.58% chance of exploitation in the next 30 days.
Description
A vulnerability was found in xlang-ai OpenAgents up to ff2e46440699af1324eb25655b622c4a131265bb and classified as critical. Affected by this issue is the function create_upload_file of the file backend/api/file.py. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The reported GitHub issue was closed automatically with the label "not planned" by a bot.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Xlang | Openagents | <= 2024-11-18 |
References
- https://github.com/xlang-ai/OpenAgents/issues/141Exploit, Issue Tracking
- https://vuldb.com/?ctiid.313286Permissions Required, VDB Entry
- https://vuldb.com/?id.313286Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.593616Third Party Advisory, VDB Entry
- https://github.com/xlang-ai/OpenAgents/issues/141Exploit, Issue Tracking
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-6282?
How severe is CVE-2025-6282?
How do I fix CVE-2025-6282?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-62813Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2025-62814An issue was discovered in Samsung Mobile Processor Exynos 1…7.5
- CVE-2025-62815An issue was discovered in Samsung Mobile Processor Exynos 1…5.5
- CVE-2025-62816An issue was discovered in Samsung Mobile Processor Exynos 1…5.5
- CVE-2025-62817An issue was discovered in Samsung Mobile Processor Exynos 1…7.5
- CVE-2025-62818An issue was discovered in Samsung Mobile Processor, Wearabl…9.8
- CVE-2025-62820Slack Nebula before 1.9.7 mishandles CIDR in some configurat…4.9
- CVE-2025-62821Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bound…9.1
- CVE-2025-62826An Improper Neutralization of CRLF Sequences in HTTP Headers…4.3
- CVE-2025-62827Rejected reason: Not used
- CVE-2025-62828Rejected reason: Not used
- CVE-2025-62829Rejected reason: Not used
Are you affected by CVE-2025-6282?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST