Qwen Agent
Monthly
Path traversal in Qwen-Agent through 0.0.34 allows unauthenticated remote attackers to read arbitrary files from the server filesystem by supplying absolute paths to the Gradio document-parsing interface. The flaw exists in the simple_doc_parser and supporting utility code, which pass caller-controlled paths directly to file-open operations without restricting access to an intended directory. The CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N) reflects a zero-prerequisite, network-accessible attack surface; no active exploitation is confirmed in CISA KEV and no public POC has been identified at time of analysis.
Server-side request forgery in Qwen-Agent through 0.0.34 allows unauthenticated remote attackers to exfiltrate data from internal infrastructure by exploiting the document parsing path's failure to validate caller-supplied URLs. The Gradio interface - exposed without authentication by default - serves as the entry point, enabling attackers to direct the server to issue HTTP requests to cloud metadata endpoints such as AWS IMDSv1 or GCP metadata APIs and retrieve responses through the document parsing output. No public exploit code or CISA KEV listing exists at time of analysis, but the zero-privilege, zero-interaction attack vector against credential-bearing metadata services makes this a high-priority risk for any cloud-hosted deployment.
Path traversal in Qwen-Agent through 0.0.34 allows unauthenticated remote attackers to read arbitrary files from the server filesystem by supplying absolute paths to the Gradio document-parsing interface. The flaw exists in the simple_doc_parser and supporting utility code, which pass caller-controlled paths directly to file-open operations without restricting access to an intended directory. The CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N) reflects a zero-prerequisite, network-accessible attack surface; no active exploitation is confirmed in CISA KEV and no public POC has been identified at time of analysis.
Server-side request forgery in Qwen-Agent through 0.0.34 allows unauthenticated remote attackers to exfiltrate data from internal infrastructure by exploiting the document parsing path's failure to validate caller-supplied URLs. The Gradio interface - exposed without authentication by default - serves as the entry point, enabling attackers to direct the server to issue HTTP requests to cloud metadata endpoints such as AWS IMDSv1 or GCP metadata APIs and retrieve responses through the document parsing output. No public exploit code or CISA KEV listing exists at time of analysis, but the zero-privilege, zero-interaction attack vector against credential-bearing metadata services makes this a high-priority risk for any cloud-hosted deployment.