What is the fix for CVE-2026-51912?

No patched release. Only v1.0.0 exists. Update to the main branch at or after commit 26f2b6e (PR #432), which adds safe_upload_path to /upload_file. Until then, do not expose ToolServer (port 12345) to untrusted networks.

Who is not affected by CVE-2026-51912?

Not affected if: built-from-main-after-26f2b6e, not-network-reachable, toolserver-not-deployed.

Live › vulnerability › CVE-2026-51912

unknownAI agents & MCP

XAgent: directory traversal in file upload lets attackers write outside the folder

OpenBMB XAgent v1.0.0 has a directory traversal flaw in its file upload handler in ToolServer/ToolServerNode/main.py. A crafted upload path can reach files outside the intended directory.

Summary written from the sources below. Check the originals before acting.

Known so far

5/6

unknown

no CVSS yet; severity from the sources

known so far5 of 6

missing: exploitation

First public: Oct 29, 2026 UTC
Last modified: Oct 29, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-29 18:26 UTC. All times on this page are UTC.

Who is affected

1 product

The flaw is in the upload handler of XAgent's ToolServer component, version 1.0.0 per the NVD entry. Teams running XAgent's ToolServer where uploads are accepted from users or other services are the ones to look at. Deployments that do not run ToolServer or do not expose its upload route can likely skip it, but the sources do not confirm this.

Product	Ecosystem	Affected	Fixed in
XAgent	pip	1.0.0 (any build before commit 26f2b6e)	–

Who cares: ai-agents, fastapi, python, self-hosted, toolserver, xagent
Not affected if: built-from-main-after-26f2b6e, not-network-reachable, toolserver-not-deployed

How to check

Run XAgent 1.0.0 or a ToolServer built from a checkout before commit 26f2b6e? Check git log for 26f2b6e.
Open ToolServer/ToolServerNode/main.py: if upload_file writes file.filename into the work directory without safe_upload_path, it is vulnerable.
Check whether port 12345 (POST /upload_file) is reachable from untrusted networks; the route has no authentication in the code.

The fix

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-51912

unknownAI agents & MCP

XAgent: directory traversal in file upload lets attackers write outside the folder

OpenBMB XAgent v1.0.0 has a directory traversal flaw in its file upload handler in ToolServer/ToolServerNode/main.py. A crafted upload path can reach files outside the intended directory.

Summary written from the sources below. Check the originals before acting.

Known so far

5/6

unknown

no CVSS yet; severity from the sources

known so far5 of 6

missing: exploitation

First public: Oct 29, 2026 UTC
Last modified: Oct 29, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-29 18:26 UTC. All times on this page are UTC.

Who is affected

1 product

Product	Ecosystem	Affected	Fixed in
XAgent	pip	1.0.0 (any build before commit 26f2b6e)	–

Who cares: ai-agents, fastapi, python, self-hosted, toolserver, xagent
Not affected if: built-from-main-after-26f2b6e, not-network-reachable, toolserver-not-deployed

How to check

Run XAgent 1.0.0 or a ToolServer built from a checkout before commit 26f2b6e? Check git log for 26f2b6e.
Open ToolServer/ToolServerNode/main.py: if upload_file writes file.filename into the work directory without safe_upload_path, it is vulnerable.
Check whether port 12345 (POST /upload_file) is reachable from untrusted networks; the route has no authentication in the code.

The fix

Know the next one before it finds you.

Add to Slack

XAgent: directory traversal in file upload lets attackers write outside the folder

Who is affected

How to check

The fix

Know the next one before it finds you.

XAgent: directory traversal in file upload lets attackers write outside the folder

Who is affected

How to check

The fix

Know the next one before it finds you.

Who had it, and when

What the sources say, verbatim

Sources