CVE-2025-67076: Path Traversal
Published Jan 15, 2026
·Updated
Directory traversal vulnerability in Omnispace Agora Project before 25.10 allowing unauthenticated attackers to read files on the system via the misc controller and the ExternalGetFile action. Only files with an extension can be read.
Affected Software
2 affected components
Omnispace Agora Project<25.10
Agora-Project Agora-Project<25.10
Event History
Jan 15, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·04:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-67076?
CVE-2025-67076 is considered a medium severity vulnerability due to its potential for unauthorized file access.
2
How do I fix CVE-2025-67076?
To fix CVE-2025-67076, upgrade to Omnispace Agora Project version 25.10 or later.
3
What types of files can be accessed in CVE-2025-67076?
In CVE-2025-67076, only files with an extension can be accessed by attackers.
4
Who is affected by CVE-2025-67076?
CVE-2025-67076 affects all versions of Omnispace Agora Project prior to 25.10.
5
What actions can attackers perform due to CVE-2025-67076?
Attackers can use the ExternalGetFile action to read restricted files on the system.