---
id: "CVE-2026-51912"
kind: "vulnerability"
aliases: ["CVE-2026-51912"]
title: "XAgent: directory traversal in file upload lets attackers write outside the folder"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "XAgent", "fixed": [], "affected": "1.0.0 (any build before commit 26f2b6e)", "ecosystem": "pip"}]
ecosystems: []
tags: ["ai-agents", "ai-tooling", "fastapi", "python", "self-hosted", "toolserver", "xagent"]
not_affected_if: ["built-from-main-after-26f2b6e", "not-network-reachable", "toolserver-not-deployed"]
published_at: "2026-10-29T18:17:32+00:00"
first_seen_at: "2026-10-29T18:26:34+00:00"
updated_at: "2026-10-29T18:30:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-51912", "first_seen_at": "2026-10-29T18:26:34+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T18:30:10+00:00"}]
---

# XAgent: directory traversal in file upload lets attackers write outside the folder

OpenBMB XAgent v1.0.0 has a directory traversal flaw in its file upload handler in ToolServer/ToolServerNode/main.py. A crafted upload path can reach files outside the intended directory.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pip:XAgent affected 1.0.0 (any build before commit 26f2b6e) fixed ?

## How to check

- Run XAgent 1.0.0 or a ToolServer built from a checkout before commit 26f2b6e? Check git log for 26f2b6e.
- Open ToolServer/ToolServerNode/main.py: if upload_file writes file.filename into the work directory without safe_upload_path, it is vulnerable.
- Check whether port 12345 (POST /upload_file) is reachable from untrusted networks; the route has no authentication in the code.

## Fix

No patched release. Only v1.0.0 exists. Update to the main branch at or after commit 26f2b6e (PR #432), which adds safe_upload_path to /upload_file. Until then, do not expose ToolServer (port 12345) to untrusted networks.

## Timeline

- 2026-10-29T18:26:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-51912
- 2026-10-29T18:30:10+00:00 analyst — No vendor advisory or NVD detail text retrievable. Maintainer repo main now routes /upload_file through safe_upload_path (utils/path_security.py), added in commit 26f2b6e (PR #432, 31 Jul 2026, 'fix high-risk code execution and path traversal'). No release after v1.0.0 (Nov 2023), so the fix exists only on main. /upload_file takes no auth in the code; ToolServer runs on port 12345. Exploitation and PoC unknown.

## Documents

- [fix] OpenBMB/XAgent: fix commit 26f2b6e (#432) adds path_security.py https://github.com/OpenBMB/XAgent/commits/main/ToolServer/ToolServerNode/utils/path_security.py
- [fix] XAgent main.py upload_file now uses safe_upload_path https://raw.githubusercontent.com/OpenBMB/XAgent/main/ToolServer/ToolServerNode/main.py
- [mentions] XAgent releases (only v1.0.0, Nov 2023) https://github.com/OpenBMB/XAgent/releases

## From the sources

OpenBMB XAgent v1.0.0 contains directory traversal vulnerability in main-upload_file-the-preserved-live-upload-file-witness-directly-reaches (ToolServer/ToolServerNode/main.py:46).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_