CVE-2026-3954: OpenBMB XAgent workspace.py workspace path traversal
A weakness has been identified in OpenBMB XAgent 1.0.0. Affected by this vulnerability is the function workspace of the file XAgentServer/application/routers/workspace.py. This manipulation of the argument filename causes path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3954?
The severity of CVE-2026-3954 is considered high due to its potential for path traversal exploitation.
How do I fix CVE-2026-3954?
To fix CVE-2026-3954, update to the latest version of OpenBMB XAgent where the path traversal vulnerability is addressed.
What systems are affected by CVE-2026-3954?
CVE-2026-3954 specifically affects OpenBMB XAgent version 1.0.0.
What kind of attack can CVE-2026-3954 enable?
CVE-2026-3954 can enable attackers to perform path traversal attacks, gaining unauthorized access to files on the server.
Is CVE-2026-3954 easily exploitable?
Yes, CVE-2026-3954 is considered easily exploitable, potentially allowing attackers to manipulate the file_name argument.