CVE-2026-26396: Path Traversal
Published Jul 13, 2026
·Updated
OpenBMB XAgent v1.0.0 and before is vulnerable to path traversal in the file() function in XAgent/XAgentServer/application/routers/workspace.py. The input parameter “filename” is user-controllable and is concatenated into the file path to be read without proper validation, leading to a directory traversal vulnerability that may result in sensitive information disclosure.
Affected Software
1 affected component
OpenBMB XAgent<=1.0.0
Event History
Jul 13, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·07:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-26396?
CVE-2026-26396 has a severity score of 7.5, categorized as high.
2
How do I fix CVE-2026-26396?
To fix CVE-2026-26396, ensure proper validation of user inputs in the file() function to prevent path traversal.
3
What software is affected by CVE-2026-26396?
CVE-2026-26396 affects OpenBMB XAgent version 1.0.0 and prior.
4
What type of vulnerability is CVE-2026-26396 classified as?
CVE-2026-26396 is classified as a Path Traversal vulnerability.
5
When was CVE-2026-26396 published?
CVE-2026-26396 was published on July 13, 2026.