CVE-2026-72713
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
XAgent contains a path traversal vulnerability in the workspace file endpoint that allows self-registered or default-credential users to read arbitrary files on the host by supplying parent-directory segments in the `file_name` form field with no path containment check. Attackers can register an account without email verification, then submit crafted `file_name` values to the `/workspace/file` handler to read host files including application secrets, database credentials, and system files outside the Docker sandbox.
Risk Assessment
The attack can lead to disclosure of sensitive data such as application secrets, database credentials, and system files, potentially enabling further system compromise.
Recommendation
Update XAgent to a patched version immediately, implement path validation in the workspace endpoint, and enforce email verification during registration.
Original NVD description (English source)
XAgent contains a path traversal vulnerability in the workspace file endpoint that allows self-registered or default-credential users to read arbitrary files on the host by supplying parent-directory segments in the `file_name` form field with no path containment check. Attackers can register an account without email verification, then submit crafted `file_name` values such as parent-directory traversal sequences to the `/workspace/file` handler to read host files including application secrets, database credentials, and system files outside the Docker sandbox.