CVE-2025-6282 is a medium severity (CVSS 5.5) path traversal (CWE-22) in xlang-ai OpenAgents up to commit ff2e46440699af1324eb25655b622c4a131265bb. It affects the function create_upload_file in backend/api/file.py, where the upload filename value can be used to reach files outside the intended folder. No confirmed fixed version is on record, so treat every copy as exposed until the code is fixed.
What's affected
The product uses continuous delivery with rolling releases, so the record gives no version numbers. It also says the reported GitHub issue was closed automatically with the label "not planned" by a bot, so there is no confirmed fix.
The record describes the weakness as a path traversal through the upload filename. The CVSS vector uses an adjacent network (AV:A), so it points to a user who is on the same local network segment, with low privileges. That is lower than a plain internet attack, and it explains the medium score. The record says the exploit has been disclosed publicly and may be used.
How to check if you're exposed
OpenAgents is open source. Check which version you run, and whether it is one of the affected builds:
pip show openagents
pip list 2>/dev/null | grep -i openagents
If you run from a Git checkout, note the commit instead:
git rev-parse HEAD
Then read the code at the function create_upload_file in backend/api/file.py and see how the upload filename value is turned into a path. If it is joined to a base folder with no check that the result stays inside that folder, your copy has the weakness. Also review which users and networks can reach the service, since the vector needs a local network position and a low privilege account.
What to do now
- Find every OpenAgents deployment, including test and demo copies on shared networks.
- Check the project issue for any fix or workaround, and update to the first release that addresses it once one exists.
- Until then, restrict network access to the service so only trusted users reach it.
- Patch your own copy: join the filename to the base folder, resolve the final path, and refuse it unless it is still inside the base folder. Also strip directory parts with a basename function.
- Run the service as a low privilege user with write access only to the folder it needs, so a traversal cannot reach system files.
Why it matters
Path traversal (CWE-22) means a filename supplied by a user is trusted as part of a file path. Sequences that climb out of a directory can then point to places the author never meant to expose. With an upload function the result can be a file written in the wrong place, and with a download function it can be a file read that should have stayed private.
AI agent projects are an especially common home for this bug. They accept files from users, tools and other models, and they often run with broad access on a developer machine or a shared server. The issue is easy to fix in code and costly to ignore when the service has broad file access.
The record does not mark this CVE as CISA Known Exploited. It does say that exploit details are public.
Quick check
Is there a fixed version?
The product uses continuous delivery with rolling releases, so the record gives no version numbers. It also says the reported GitHub issue was closed automatically with the label "not planned" by a bot, so there is no confirmed fix.
How do I prevent this in my own code?
Never use a client supplied filename directly. Generate your own file names, or take only the basename, join it to a fixed base folder, resolve the full path and confirm it still lies inside that folder.
Sources
Last reviewed: 18 October 2026.
