Which versions of XAgent are affected by CVE-2025-6281?

Organizations using OpenBMB XAgent should be aware of moderate risk from CVE-2025-6281, a path traversal vulnerability rated CVSS 5.5. This could allow unauthorized file access.

How to fix or mitigate CVE-2025-6281?

Within 30 days: Identify affected systems running OpenBMB XAgent and apply vendor patches as part of regular patch cycle. Review file handling controls.

XAgent CVE-2025-6281

Q: What is the CVSS score of CVE-2025-6281?

CVE-2025-6281 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-18701 LOW

Path Traversal (CWE-22)

2025-06-19 cna@vuldb.com

Path Traversal Xagent Openbmb

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.5 LOW

Adjacent network, low privileges, low confidentiality impact only.

3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.5 (MEDIUM) 2.0 (LOW)

EUVD ID Assigned

Mar 15, 2026 - 00:08 euvd

EUVD-2025-18701

Analysis Generated

Mar 15, 2026 - 00:08 vuln.today

CVE Published

Jun 19, 2025 - 22:15 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability has been found in OpenBMB XAgent up to 1.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /conv/community. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used.

AnalysisAI

Path traversal vulnerability in OpenBMB XAgent up to version 1.0.0 allows attackers to read arbitrary files via the /conv/community endpoint. Public exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.09%), indicating limited exploitation likelihood.

Technical ContextAI

The vulnerability is a path traversal (CWE-22) in the /conv/community endpoint of XAgent, an AI agent framework. CPE data confirms affected version is 1.0.0. Path traversal allows an attacker to access files outside the intended directory by manipulating file paths, potentially exposing sensitive configuration or data files.

RemediationAI

Upgrade to a patched version of XAgent beyond 1.0.0 if available. As no official patch is confirmed, restrict network access to the /conv/community endpoint using firewall rules or web application firewall (WAF) to block path traversal patterns. Monitor for unusual file access attempts. Side effect: restricting access may break legitimate functionality if the endpoint is used for valid operations.