Path Traversal Vulnerability in XAgent by OpenBMB

CVE-2026-72713

What is CVE-2026-72713?

The XAgent product by OpenBMB features a path traversal vulnerability that exists within the workspace file handling endpoint. This flaw permits users, including self-registered and those using default credentials, to exploit the system by injecting parent-directory traversal sequences in the 'file_name' input. Without proper path containment checks, malicious users can retrieve sensitive host files such as application secrets and database credentials. The vulnerability arises from the capability to register accounts without email verification, granting unauthorized access to critical system data stored outside of the Docker environment.

References