What is the CVSS score of CVE-2025-6166?

CVE-2025-6166 has a CVSS 3.1 base score of 3.5 (Low). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Python are affected by CVE-2025-6166?

CVE-2025-6166 is a low-severity vulnerability in frdel Agent-Zero involving path traversal (CVSS 3.5).. A patch is available.

Is there a public PoC exploit available for CVE-2025-6166?

Yes, a public proof-of-concept exploit is available for CVE-2025-6166. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6166?

During next maintenance window: Apply vendor patches when convenient. Verify path traversal controls are in place.

Python CVE-2025-6166

EUVD-2025-18479 LOW

Path Traversal (CWE-22)

2025-06-17 cna@vuldb.com

Python Path Traversal

3.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.5 LOW

AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18479

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

Patch released

Mar 14, 2026 - 22:15 nvd

Patch available

PoC Detected

Jan 08, 2026 - 14:46 vuln.today

Public exploit code

CVE Published

Jun 17, 2025 - 06:15 nvd

LOW 3.5

DescriptionCVE.org

A vulnerability was found in frdel Agent-Zero up to 0.8.4. It has been rated as problematic. This issue affects the function image_get of the file /python/api/image_get.py. The manipulation of the argument path leads to path traversal. Upgrading to version 0.8.4.1 is able to address this issue. The identifier of the patch is 5db74202d632306a883ccce7339c5bdba0d16c5a. It is recommended to upgrade the affected component.

Analysis

Technical ContextAI

Path traversal allows an attacker to access files outside the intended directory by manipulating file paths with sequences like '../'.

RemediationAI

A vendor patch is available — apply it immediately. Validate and sanitize file path inputs. Use a whitelist of allowed files or directories. Implement chroot jails or containerization.

More from same product – last 7 days

CVE-2026-48039 CRITICAL Act Now POC

9.1 Jun 11

Unauthenticated remote attackers can invoke MCP tool handlers and exfiltrate the operator's long-lived Meta Graph API ac

CVE-2026-20251 HIGH This Week

8.8 Jun 10

Remote code execution in Splunk Enterprise, Splunk Cloud Platform, and the Splunk Secure Gateway app allows a low-privil

CVE-2026-53753 CRITICAL Act Now

9.8 Jun 16

Unauthenticated remote code execution in Crawl4AI versions <= 0.8.6 allows attackers to escape the AST-based sandbox in

CVE-2026-48519 CRITICAL Act Now

9.6 Jun 16

Remote code execution in Langflow versions through 1.9.1 allows unauthenticated attackers to execute arbitrary Python co

CVE-2026-45833 CRITICAL Act Now

9.4 Jun 12

Authenticated remote code execution in ChromaDB Python project versions 0.4.17 and later enables attackers holding the U

CVE-2025-6166 vulnerability details – vuln.today

Back

Python CVE-2025-6166

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Analysis

Technical ContextAI

RemediationAI

More from same product – last 7 days

Share

External POC / Exploit Code