{"id":"CVE-2026-51912","kind":"vulnerability","aliases":["CVE-2026-51912"],"related":[],"title":"XAgent: directory traversal in file upload lets attackers write outside the folder","description":"OpenBMB XAgent v1.0.0 contains directory traversal vulnerability in main-upload_file-the-preserved-live-upload-file-witness-directly-reaches (ToolServer/ToolServerNode/main.py:46).","summary":"OpenBMB XAgent v1.0.0 has a directory traversal flaw in its file upload handler in ToolServer/ToolServerNode/main.py. A crafted upload path can reach files outside the intended directory.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"XAgent","fixed":[],"affected":"1.0.0 (any build before commit 26f2b6e)","ecosystem":"pip"}],"ecosystems":[],"tags":["ai-agents","ai-tooling","fastapi","python","self-hosted","toolserver","xagent"],"not_affected_if":["built-from-main-after-26f2b6e","not-network-reachable","toolserver-not-deployed"],"how_to_check":"- Run XAgent 1.0.0 or a ToolServer built from a checkout before commit 26f2b6e? Check git log for 26f2b6e.\n- Open ToolServer/ToolServerNode/main.py: if upload_file writes file.filename into the work directory without safe_upload_path, it is vulnerable.\n- Check whether port 12345 (POST /upload_file) is reachable from untrusted networks; the route has no authentication in the code.","fix":"No patched release. Only v1.0.0 exists. Update to the main branch at or after commit 26f2b6e (PR #432), which adds safe_upload_path to /upload_file. Until then, do not expose ToolServer (port 12345) to untrusted networks.","status":"open","published_at":"2026-10-29T18:17:32+00:00","first_seen_at":"2026-10-29T18:26:34+00:00","triaged_at":"2026-10-29T18:28:49+00:00","updated_at":"2026-10-29T18:30:10+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-29T18:28:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"XAgent: directory traversal in file upload lets attackers write outside the folder","impact":"high","summary":"OpenBMB XAgent v1.0.0 has a directory traversal flaw in its file upload handler in ToolServer/ToolServerNode/main.py. A crafted upload path can reach files outside the intended directory.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["xagent","toolserver","python","ai-agents"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker writes files to arbitrary server paths; possible code execution","analyst_note":"Confirm the vulnerable route, whether authentication is required, and whether a fixed version exists; check the NVD entry and the OpenBMB XAgent repository advisories.","how_to_check":"- Check whether you run XAgent `1.0.0` or a build of ToolServer from this project.\n- Look at `ToolServer/ToolServerNode/main.py` around line 46 for the upload_file handler and whether file names are sanitized.\n- Check whether the ToolServer port is reachable from untrusted networks.","plain_action":"","needs_analyst":true,"not_affected_if":["toolserver-not-deployed"],"who_is_affected":"The flaw is in the upload handler of XAgent's ToolServer component, version 1.0.0 per the NVD entry. Teams running XAgent's ToolServer where uploads are accepted from users or other services are the ones to look at. Deployments that do not run ToolServer or do not expose its upload route can likely skip it, but the sources do not confirm this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000718,"input_tokens":4091,"output_tokens":618,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the vulnerable route, whether authentication is required, and whether a fixed version exists; check the NVD entry and the OpenBMB XAgent repository advisories.","search":"'-2026':14A,17A '-51912':15A,18A '46':81C 'agent':22B 'ai':21B,24B 'ai-ag':20B 'ai-tool':23B 'attack':8A 'contain':62C 'craft':49B 'cve':13A,16A 'direct':78C 'directori':2A,38B,58B,63C 'fastapi':26B 'file':5A,43B,54B,71C,76C 'file-the-preserved-live-upload-file-witness-directly-reach':70C 'flaw':40B 'folder':12A 'handler':45B 'host':30B 'intend':57B 'let':7A 'live':74C 'main':68C 'main-upload':67C 'openbmb':33B,59C 'outsid':10A,55B 'path':51B 'preserv':73C 'python':27B 'reach':53B,79C 'self':29B 'self-host':28B 'tool':25B 'toolserv':31B 'toolserver/toolservernode/main.py':47B,80C 'travers':3A,39B,64C 'upload':6A,44B,50B,69C,75C 'v1.0.0':35B,61C 'vulner':65C 'wit':77C 'write':9A 'xagent':1A,19A,32B,34B,60C","nicknames":[],"mitigations":[],"who_affected":"The flaw is in the upload handler of XAgent's ToolServer component, version 1.0.0 per the NVD entry. Teams running XAgent's ToolServer where uploads are accepted from users or other services are the ones to look at. Deployments that do not run ToolServer or do not expose its upload route can likely skip it, but the sources do not confirm this.","tier":"B","verified":{"fix":{"at":"2026-10-29T18:30:10Z","by":"analyst","doc":"https://raw.githubusercontent.com/OpenBMB/XAgent/main/ToolServer/ToolServerNode/main.py","run_id":1090}},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T18:17:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-51912","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-51912","severity":null,"published_at":"2026-10-29T18:17:32+00:00","modified_at":"2026-10-29T18:17:32+00:00","first_seen_at":"2026-10-29T18:26:34+00:00","fetched_at":"2026-10-29T18:26:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-51912:1090","url":null,"severity":null,"published_at":"2026-10-29T18:30:10+00:00","modified_at":"2026-10-29T18:30:10+00:00","first_seen_at":"2026-10-29T18:30:10+00:00","fetched_at":"2026-10-29T18:30:10+00:00","note":"No vendor advisory or NVD detail text retrievable. Maintainer repo main now routes /upload_file through safe_upload_path (utils/path_security.py), added in commit 26f2b6e (PR #432, 31 Jul 2026, 'fix high-risk code execution and path traversal'). No release after v1.0.0 (Nov 2023), so the fix exists only on main. /upload_file takes no auth in the code; ToolServer runs on port 12345. Exploitation and PoC unknown."}],"documents":[{"id":18580,"url":"https://github.com/OpenBMB/XAgent/commits/main/ToolServer/ToolServerNode/utils/path_security.py","title":"OpenBMB/XAgent: fix commit 26f2b6e (#432) adds path_security.py","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":18581,"url":"https://raw.githubusercontent.com/OpenBMB/XAgent/main/ToolServer/ToolServerNode/main.py","title":"XAgent main.py upload_file now uses safe_upload_path","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":18582,"url":"https://github.com/OpenBMB/XAgent/releases","title":"XAgent releases (only v1.0.0, Nov 2023)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}