Description

XAgent contains a path traversal vulnerability in the workspace file endpoint that allows self-registered or default-credential users to read arbitrary files on the host by supplying parent-directory segments in the `file_name` form field with no path containment check. Attackers can register an account without email verification, then submit crafted `file_name` values such as parent-directory traversal sequences to the `/workspace/file` handler to read host files including application secrets, database credentials, and system files outside the Docker sandbox.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-11T18:18:23.717Z",
  "pubdate": "2026-08-11T18:18:23.717Z",
  "executiveSummary": "XAgent suffers from a critical path traversal vulnerability residing within the workspace file endpoint.\nThe flaw enables authenticated users, including those utilizing self-registration without email verification or default credentials, to read arbitrary files from the underlying host system.\nThe vulnerability stems from the complete absence of path containment checks on the file_name form field.\nSuccessful exploitation allows malicious actors to retrieve sensitive information such as application secrets, database credentials, and system files located outside the intended Docker sandbox.\nThe risk implication is severe, as unauthorized data disclosure can lead to complete system compromise or credential harvesting.\nPrerequisites for exploitation include the ability to register an account or access the application via default credentials, followed by submitting crafted payloads directly to the vulnerable handler.",
  "technicalDetails": "The vulnerability exists in the workspace file endpoint, specifically targeting the /workspace/file handler of XAgent.\nThe root cause is inadequate input sanitization and a total lack of path containment logic within the file retrieval mechanism.\nWhen processing user input, the application fails to validate or sanitize the file_name form field supplied in requests.\nAttackers exploit this flaw by injecting parent-directory traversal sequences, such as dot-dot-slash patterns, directly into the file_name parameter.\nBecause the application processes these path segments without enforcing boundaries, it traverses outside the designated workspace directory and resolves paths relative to the host filesystem root.\nAuthentication requirements are minimal; attackers can easily satisfy them by performing a self-registration process that bypasses email verification or by leveraging pre-existing default credentials.\nNetwork exposure encompasses any interface where the XAgent application accepts HTTP requests to the workspace file endpoint.\nThe payload behavior involves supplying sequences designed to navigate upward in the directory tree, allowing the reading of arbitrary files.\nPost-exploitation impact includes the unauthorized extraction of highly sensitive assets, including application secrets, database connection strings, and critical system files residing outside the intended Docker sandbox isolation."
}