Skip to content
OpenAdvisories

Product · OpenBMB

XAgent

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2026-72713

    XAgent Path Traversal Arbitrary File Read via /workspace/file

    XAgent contains a path traversal vulnerability in the workspace file endpoint that allows self-registered or default-credential users to read arbitrary files on the host by supplying parent-directory segments in the `file_name` form field with no path contain…

    OpenBMB XAgent
  • High 7.3
    CVE-2026-4959

    OpenBMB XAgent ShareServer WebSocket Endpoint share.py check_user missing authentication

    A vulnerability was found in OpenBMB XAgent 1.0.0. This impacts the function check_user of the file XAgentServer/application/websockets/share.py of the component ShareServer WebSocket Endpoint. Performing a manipulation of the argument interaction_id results …

    OpenBMB XAgent