CVE-2026-51912
OpenBMB XAgent v1.0.0 contains directory traversal vulnerability in…
- Risk score
- 67/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 29 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- OpenBMB XAgent v1.0.0 contains a directory traversal vulnerability in main-upload_file-the-preserved-live-upload-file-witness-directly-reaches (ToolServer/ToolServerNode/main.py:46). An attacker could exploit this vulnerability to gain high privileges, read, write, and delete files.
- Affected
- {'products': ['OpenBMB XAgent'], 'packages': [], 'versions': ['v1.0.0']}
- Fix
- Check the linked advisory for a fix, as none is provided.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
OpenBMB XAgent v1.0.0 contains directory traversal vulnerability in main-upload_file-the-preserved-live-upload-file-witness-directly-reaches (ToolServer/ToolServerNode/main.py:46).
Last activity 29 Oct 2026. Patch Forecast updates every hour.