Description

Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that fails to restrict file access to intended directories. Attackers can supply absolute file paths to the unauthenticated Gradio interface to read arbitrary files accessible by the server process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T20:20:18.507Z",
  "pubdate": "2026-08-28T20:20:18.507Z",
  "executiveSummary": "Qwen-Agent versions 0.0.34 and earlier are susceptible to a critical path traversal vulnerability within the document parser component. This flaw arises from insufficient input validation when processing file paths, allowing unauthenticated remote attackers to bypass directory restrictions enforced by the application.\nThe vulnerability resides within the Gradio interface exposed by the server. By supplying specially crafted, absolute file paths as input to the document parser, an attacker can coerce the application into reading arbitrary files from the underlying host filesystem that the server process has permission to access. This capability grants an attacker unauthorized access to sensitive system configurations, application source code, environment variables, and credential files.\nGiven that the Gradio interface is typically exposed over the network, this vulnerability presents a significant risk to the confidentiality of the server environment. Successful exploitation requires no authentication, allowing any remote user with access to the interface to compromise sensitive data. Immediate remediation is required to restrict file access to predefined, safe directories and to ensure robust sanitization of user-provided file path inputs.",
  "technicalDetails": "The vulnerability is a classic path traversal (CWE-22) residing in the document parser logic of the Qwen-Agent framework, specifically impacting versions 0.0.34 and below. The root cause is the failure of the document parser to sanitize or validate user-supplied file path inputs before passing them to file system APIs.\nWhen a user interacts with the Gradio-based interface provided by Qwen-Agent, the application accepts file inputs for processing. The backend implementation fails to implement proper path normalization or boundary checks. Consequently, the application does not prevent the use of absolute paths or escape sequences (such as '../') to traverse outside of the intended root directory.\nThe attack flow proceeds as follows: First, an attacker identifies the endpoint associated with the document parser functionality within the Gradio web interface. Second, the attacker crafts a malicious request containing an absolute file path pointing to a sensitive file on the server (e.g., /etc/passwd or application configuration files). Third, the application's document parser accepts this malicious path as a valid input. Finally, because the server process executes the read operation without verifying if the requested file resides within an authorized 'sandbox' or document directory, the file system API accesses and returns the content of the arbitrary file to the attacker via the interface response.\nThis vulnerability is particularly severe because the Gradio interface is often exposed over HTTP/HTTPS, providing a broad network attack surface. Because the application does not require authentication to interact with the document parser, the barrier to entry for an attacker is minimal. The technical impact is limited to unauthorized file disclosure; however, the ability to read arbitrary files often leads to full system compromise if the attacker is able to extract authentication tokens, cryptographic keys, or database credentials stored in the application's environment. The vulnerability effectively allows an attacker to operate within the security context of the user running the Qwen-Agent service."
}