XAgent has a path traversal flaw in the /workspace/file endpoint. The handler accepts a form field called file_name without enforcing path containment, allowing an attacker who can register an account or use default credentials to supply directory‑traversal sequences. This leads to arbitrary file reads, so secrets such as application configuration, database credentials, or host system files could be leaked. The weakness is a CWE‑22 style input validation flaw.

The affected product is OpenBMB XAgent. No specific version range is listed in the advisory, so all current releases should be treated as potentially vulnerable until a patch release is identified.

The vulnerability carries a CVSS score of 8.7, classifying it as high severity. However, the EPSS score is below 1 %, suggesting that the likelihood of exploitation in the wild is currently low. The attack can be carried out over HTTP by first registering an account (without email verification) or leveraging a default account, then posting a crafted file_name payload to the /workspace/file endpoint. This lack of authentication checks and path validation makes the flaw directly exploitable by a remote attacker. There is no entry in the CISA KEV catalogue, but the high CVSS warrants prompt attention.