CVE-2026-82275
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that fails to restrict file access to intended directories. Attackers can supply absolute file paths to the unauthenticated Gradio interface to read arbitrary files accessible by the server process.
Risk Assessment
The risk includes unauthorized reading of sensitive files such as configuration files, keys, or user data, potentially leading to information disclosure and further attacks.
Recommendation
Update Qwen-Agent to a patched version and implement path validation in the document parser. Also restrict access to the Gradio interface.
Other vulnerabilities in Qwen-Agent
Original NVD description (English source)
Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that fails to restrict file access to intended directories. Attackers can supply absolute file paths to the unauthenticated Gradio interface to read arbitrary files accessible by the server process.