Skip to main content

Agent CVE-2025-6283

| EUVDEUVD-2025-18705 LOW
Path Traversal (CWE-22)
2025-06-19 cna@vuldb.com
3.5
CVSS 3.1 · NVD

Severity by source

NVD PRIMARY
3.5 LOW
AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

5
EUVD ID Assigned
Mar 15, 2026 - 00:08 euvd
EUVD-2025-18705
Analysis Generated
Mar 15, 2026 - 00:08 vuln.today
Patch released
Mar 15, 2026 - 00:08 nvd
Patch available
PoC Detected
Sep 30, 2025 - 18:32 vuln.today
Public exploit code
CVE Published
Jun 19, 2025 - 23:15 nvd
LOW 3.5

DescriptionCVE.org

A vulnerability was found in xataio Xata Agent up to 0.3.0. It has been classified as problematic. This affects the function GET of the file apps/dbagent/src/app/api/evals/route.ts. The manipulation of the argument passed leads to path traversal. Upgrading to version 0.3.1 is able to address this issue. The patch is named 03f27055e0cf5d4fa7e874d34ce8c74c7b9086cc. It is recommended to upgrade the affected component.

Analysis

A vulnerability was found in xataio Xata Agent up to 0.3.0. It has been classified as problematic. This affects the function GET of the file apps/dbagent/src/app/api/evals/route.ts. The manipulation of the argument passed leads to path traversal. Upgrading to version 0.3.1 is able to address this issue. The patch is named 03f27055e0cf5d4fa7e874d34ce8c74c7b9086cc. It is recommended to upgrade the affected component.

Technical ContextAI

Path traversal allows an attacker to access files outside the intended directory by manipulating file paths with sequences like '../'.

RemediationAI

A vendor patch is available — apply it immediately. Validate and sanitize file path inputs. Use a whitelist of allowed files or directories. Implement chroot jails or containerization.

More in Agent

View all
CVE-2018-6703 CRITICAL
9.8 Dec 11

Use After Free in Remote logging (which is disabled by default) in McAfee McAfee Agent (MA) 5.x prior to 5.6.0 allows re

CVE-2022-1257 MEDIUM POC
5.5 Apr 14

Insecure storage of sensitive information vulnerability in MA for Linux, macOS, and Windows prior to 5.7.6 allows a loca

CVE-2016-3984 MEDIUM POC
5.1 Apr 08

The McAfee VirusScan Console (mcconsol.exe) in McAfee Active Response (MAR) before 1.1.0.161, Agent (MA) 5.x before 5.0.

CVE-2021-1257 HIGH
8.8 Jan 20

A vulnerability in the web-based management interface of Cisco DNA Center Software could allow an unauthenticated, remot

CVE-2026-6788 HIGH
8.5 May 06

Local privilege escalation in WatchGuard Agent for Windows allows authenticated users to execute arbitrary code with ele

CVE-2026-6787 HIGH
8.5 May 06

Hard-coded cryptographic key in WatchGuard Agent for Windows enables local authenticated attackers to inject malicious c

CVE-2023-1388 HIGH
8.1 Jun 07

A heap-based overflow vulnerability in TA prior to version 5.7.9 allows a remote user to alter the page heap in the macm

CVE-2023-41743 HIGH
7.8 Aug 31

Local privilege escalation due to insecure driver communication port permissions. Rated high severity (CVSS 7.8), this v

CVE-2025-5480 HIGH
7.8 Jun 06

Local privilege escalation vulnerability in Action1 where an attacker with low-privileged code execution can exploit an

CVE-2026-28727 HIGH
7.8 Mar 06

Acronis Cyber Protect and Cloud Agent on macOS before specific builds contain an insecure Unix socket permissions vulner

CVE-2024-8996 HIGH
7.8 Sep 25

Unquoted Search Path or Element vulnerability in Grafana Agent (Flow mode) on Windows allows Privilege Escalation from L

CVE-2023-44209 HIGH
7.8 Oct 04

Local privilege escalation due to improper soft link handling. Rated high severity (CVSS 7.8), this vulnerability is low

Share

CVE-2025-6283 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy