CVE-2026-82275: Qwen-Agent Path Traversal Vulnerability

CVE-2026-82275 Overview

CVE-2026-82275 is a path traversal vulnerability [CWE-22] in Qwen-Agent through version 0.0.34. The document parser fails to restrict file access to intended directories. Attackers can supply absolute file paths to the unauthenticated Gradio interface to read arbitrary files accessible by the server process.

The flaw resides in the simple_doc_parser.py component and associated utility functions in utils.py. Because the Gradio interface does not require authentication, remote attackers can exploit the issue without credentials or user interaction.

Critical Impact
Unauthenticated remote attackers can read arbitrary files on the host system, including configuration files, credentials, private keys, and application source code accessible to the Qwen-Agent process.

Affected Products

Qwen-Agent through version 0.0.34
Deployments exposing the Qwen-Agent Gradio web interface
Applications embedding the simple_doc_parser tool from qwen_agent.tools

Discovery Timeline

2026-08-28 - CVE-2026-82275 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82275

Vulnerability Analysis

Qwen-Agent is a framework from Alibaba's Qwen team for building large language model (LLM) agents with tool-use capabilities. The framework ships with a document parsing tool exposed through a Gradio web interface for interactive use.

The document parser accepts a file path parameter and reads the referenced file to feed its contents to the LLM agent. The parser resolves paths without confining reads to a designated documents directory, and the Gradio front end does not require authentication before invoking parser tools.

An attacker with network reach to the Gradio interface can request parsing of arbitrary absolute paths. The server process returns file contents in the agent response, resulting in disclosure of any file the process can read.

Root Cause

The root cause is missing path canonicalization and sandboxing in qwen_agent/tools/simple_doc_parser.py and helper routines in qwen_agent/utils/utils.py. The code treats caller-supplied paths as trusted rather than validating them against an allow-listed base directory. This is a textbook CWE-22 pattern compounded by the absence of authentication on the exposing Gradio surface.

Attack Vector

Exploitation is remote and network-based. An attacker submits a document parsing request through the Gradio interface, specifying an absolute path such as /etc/passwd, /root/.ssh/id_rsa, or a Python virtual environment file containing API keys. The parser opens the path, extracts textual content, and returns it in the agent response. No authentication, privilege, or user interaction is required.

For technical details of the vulnerable code paths, see the Simple Doc Parser source, the utility functions, and the VulnCheck advisory.

Detection Methods for CVE-2026-82275

Indicators of Compromise

Gradio HTTP requests to the document parser tool endpoint containing absolute file paths (leading / on Linux or drive letters on Windows) or ../ traversal sequences.
Qwen-Agent process reads of sensitive files outside the expected documents working directory, such as /etc/passwd, /etc/shadow, ~/.ssh/, ~/.aws/credentials, or .env files.
Outbound responses from the Gradio service containing contents of system or credential files.

Detection Strategies

Inspect Gradio access logs for simple_doc_parser invocations referencing paths outside the designated document upload directory.
Correlate open() and read() syscalls from the Qwen-Agent Python process against an allow list of expected paths using EDR file-access telemetry.
Deploy web application firewall rules that flag path parameters containing absolute paths or traversal sequences submitted to Gradio endpoints.

Monitoring Recommendations

Alert on unauthenticated Gradio interfaces reachable from untrusted networks by scanning for exposed Qwen-Agent deployments on default ports.
Monitor for anomalous file-read patterns by the Python interpreter hosting Qwen-Agent, particularly reads of credential stores and SSH key material.
Baseline the working directory of the Qwen-Agent service and alert on file access outside that boundary.

How to Mitigate CVE-2026-82275

Immediate Actions Required

Restrict network exposure of the Qwen-Agent Gradio interface to trusted management networks or place it behind an authenticating reverse proxy.
Run the Qwen-Agent process under a dedicated low-privilege service account with filesystem access limited to the documents directory.
Rotate any credentials, API tokens, or private keys that may have been readable by the Qwen-Agent process during exposure.

Patch Information

At the time of publication, the enriched CVE data does not identify a fixed release. Track the Qwen-Agent repository and GitHub Issue #912 for remediation status, and consult the VulnCheck advisory for updated guidance.

Workarounds

Front the Gradio interface with an authenticating reverse proxy such as nginx or an identity-aware proxy, blocking anonymous access to tool endpoints.
Deploy Qwen-Agent inside a container with a read-only root filesystem and bind-mount only the documents directory as writable, limiting the blast radius of arbitrary file read.
Apply a local wrapper around simple_doc_parser that canonicalizes the requested path with os.path.realpath and rejects any path that does not begin with the approved documents base directory.
Disable the document parser tool in the agent configuration if it is not required for the deployment.

bash

# Configuration example: run Qwen-Agent in a restricted container
docker run --rm \
  --read-only \
  --user 1001:1001 \
  --network internal-net \
  -v /srv/qwen/docs:/app/docs:ro \
  --cap-drop ALL \
  qwen-agent:pinned