CVE-2026-72713: XAgent Path Traversal Vulnerability

CVE-2026-72713 Overview

CVE-2026-72713 is a path traversal vulnerability [CWE-22] in XAgent, an autonomous AI agent framework by OpenBMB. The flaw resides in the /workspace/file handler, which fails to validate parent-directory segments supplied in the file_name form field. Attackers who self-register an account, or authenticate with default credentials, can read arbitrary files on the host outside the Docker sandbox. Exploitable targets include application secrets, database credentials, and system configuration files. The vulnerability requires no user interaction and is exploitable over the network.

Critical Impact
Unauthenticated or low-privileged attackers can read arbitrary files on the XAgent host, including credentials and secrets, by submitting crafted file_name values containing directory traversal sequences.

Affected Products

OpenBMB XAgent (workspace file endpoint)
Deployments exposing the /workspace/file handler
Docker-based XAgent instances with default or self-registered credentials

Discovery Timeline

2026-08-11 - CVE-2026-72713 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72713

Vulnerability Analysis

The vulnerability exists in XAgent's ToolServer component, specifically in the workspace file handler. The endpoint accepts a file_name form field and uses it to construct a filesystem path without enforcing that the resolved path stays within the intended workspace directory. Attackers can supply ../ sequences to traverse out of the workspace and read files elsewhere on the container or host filesystem.

Because XAgent permits account self-registration without email verification, and ships with default credentials, an attacker can obtain a valid session before invoking the vulnerable endpoint. The response returns the file contents, resulting in arbitrary file read.

Root Cause

The root cause is missing path containment validation in the /workspace/file handler. User-controlled input flows directly into a filesystem operation without canonicalization or a check that the resolved path is a descendant of the intended workspace root. This is a classic [CWE-22] Improper Limitation of a Pathname to a Restricted Directory pattern.

Attack Vector

The attack requires network access to the XAgent web interface. An attacker registers an account or uses default credentials, then submits a POST request to the workspace file endpoint with a file_name value such as ../../etc/passwd or ../../app/config/secrets.yml. The server returns the file's contents, bypassing the intended Docker sandbox boundary for filesystem reads.

python

// Security patch introducing path containment helpers
from utils.retriever import ada_retriever,build_tool_embeddings
from utils.response import wrap_tool_response
from utils.path_security import safe_upload_path, safe_workspace_path

app = FastAPI()

Source: GitHub Commit 26f2b6e. The patch introduces safe_upload_path and safe_workspace_path helpers that enforce path containment before filesystem access.

Detection Methods for CVE-2026-72713

Indicators of Compromise

HTTP requests to /workspace/file containing ../ sequences or URL-encoded variants such as %2e%2e%2f in the file_name field
New account registrations followed by immediate access to the workspace file endpoint
Application logs showing reads of files outside the intended workspace directory (for example /etc/passwd, .env, gpt4_config.yml)
Outbound exfiltration of file contents shortly after XAgent authentication events

Detection Strategies

Deploy WAF or reverse-proxy rules that flag .., encoded traversal sequences, and absolute paths in requests to /workspace/file
Correlate self-registration events with subsequent file endpoint access using SIEM analytics
Baseline expected filenames read via the workspace endpoint and alert on deviations

Monitoring Recommendations

Enable verbose access logging on the XAgent ToolServer and forward to a centralized log platform
Monitor container filesystem read events for sensitive paths such as /etc/, /root/, and mounted secret volumes
Alert on repeated failed or successful reads of configuration files including gpt4_config.yml and .env

How to Mitigate CVE-2026-72713

Immediate Actions Required

Upgrade XAgent to the version containing commit 26f2b6e or later, which adds safe_upload_path and safe_workspace_path enforcement
Disable self-registration and rotate any default credentials on exposed XAgent deployments
Restrict network exposure of the XAgent web interface to trusted networks or VPN only
Rotate any secrets, API keys, and database credentials that may have been readable from the host

Patch Information

The upstream fix is tracked in GitHub Pull Request #432 and merged as commit 26f2b6edc75127af524f027c022b382967178e3a. The related issue is documented in GitHub Issue #429. Additional analysis is available in the VulnCheck Security Advisory.

Workarounds

Place a reverse proxy in front of XAgent that rejects requests containing .., %2e%2e, or absolute path prefixes in the file_name parameter
Run XAgent under a dedicated non-root user with filesystem access restricted to the workspace directory via mount options
Remove or protect sensitive files from the container image and mount secrets read-only from paths outside any traversable directory
Disable account self-registration until upgrade is complete

bash

# Example nginx rule to block traversal in the file_name field
location /workspace/file {
    if ($request_body ~* "(\.\./|%2e%2e%2f|%2E%2E%2F)") {
        return 403;
    }
    proxy_pass http://xagent_backend;
}