CVE-2025-6167 is a medium (CVSS 5.5) path traversal in python-a2a up to version 0.5.5. The create_workflow function in the agent flow server API does not keep paths inside the intended folder. The fix is python-a2a 0.5.6, so upgrade and check any server you exposed to a network.
What's affected
- Product: python-a2a, a Python library for agent-to-agent communication.
- Affected: versions up to 0.5.5.
- Vulnerable code: the
create_workflowfunction inpython_a2a/agent_flow/server/api.py. - Weakness: CWE-22, path traversal.
- Fixed: 0.5.6, per the record and the release it links.
- CVSS 3.1: 5.5, vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The attack vector is the adjacent network, and a low-privilege account is needed. - Known exploited: no, the record is not on the CISA KEV list.
How to check if you're exposed
Check the installed version in each environment:
pip show python-a2a
pip list | grep -i a2a
pip freeze | grep -i a2a
For projects, also check requirements.txt, pyproject.toml and lockfiles for pins at 0.5.5 or lower. Container images can carry an older copy, so check the image layers or run pip show inside the container.
Then ask whether the agent flow server is running. The vulnerable function sits in the server API for agent flows. If you only use the client side of the library, your exposure is lower. If you run the flow server on a shared network segment, the adjacent-network vector applies to you.
What to do now
- Upgrade python-a2a to 0.5.6 or later with
pip install --upgrade python-a2a, then update your lockfile. - Rebuild and redeploy container images so the new version is in place.
- If you run the agent flow server, keep it off shared networks and require authentication in front of it.
- Run the service with an operating system account that can write only to its own workflow folder.
- Check the folders the server writes to for unexpected files.
- Use the free in-browser dependency scan to see which projects pull in python-a2a, directly or indirectly.
Why it matters
Path traversal (CWE-22) means a path built from input is not confined to a safe folder. A workflow name or similar value that includes directory climbing sequences can lead the code to read or write outside its own space.
The score is medium because an attacker needs a foothold on the adjacent network and a low-privilege account, and the impact metrics are low. That makes it a good candidate for reachability thinking: the library is only a risk where the flow server is actually run and reachable.
Agent frameworks are being adopted quickly, and many ship servers that assume a trusted network. Check how yours is deployed rather than relying on the default. The record does not claim exploitation in the wild.
Quick check
What version fixes it?
python-a2a 0.5.6 addresses the issue, per the record.
Am I affected if I only use the client?
The flaw is in the agent flow server API. If you do not run that server, your exposure is much lower, but upgrading is still sensible.
Sources
- python-a2a release v0.5.6 (listed in the CVE record, not fetched)
- Safeguard Gold entry for CVE-2025-6167
Last reviewed: 18 October 2026.
