CVE-2025-6166

A vulnerability was found in frdel Agent-Zero up to 0.8.4. It has been rated as problematic. This issue affects the function image_get of the file /python/api/image_get.py. The manipulation of the argument path leads to path traversal. Upgrading to version 0.8.4.1 is able to address this issue. The identifier of the patch is 5db74202d632306a883ccce7339c5bdba0d16c5a. It is recommended to upgrade the affected component.

CVSS v3 3.5 LOW
CVSS v2.0 2.7 LOW

3.5^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.1 / Impact : 1.4

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.7^/10

CVSS v2.0 : LOW

Vector : AV:A/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 5.1 / Impact : 2.9

Access Vector ADJACENT_NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://github.com/frdel/agent-zero/commit/5db74202d632306a883ccce7339c5bdba0d16c5a
https://github.com/frdel/agent-zero/issues/383
https://github.com/frdel/agent-zero/issues/383#issuecomment-2893239897
https://github.com/frdel/agent-zero/releases/tag/v0.8.4.1
https://vuldb.com/?ctiid.312641
https://vuldb.com/?id.312641
https://vuldb.com/?submit.593611

Configurations

No configuration.

History

17 Jun 2025, 20:50

Type	Values Removed	Values Added
Summary		(es) Se encontró una vulnerabilidad en frdel Agent-Zero hasta la versión 0.8.4. Se ha clasificado como problemática. Este problema afecta a la función image_get del archivo /python/api/image_get.py. La manipulación del argumento path provoca un path traversal. Actualizar a la versión 0.8.4.1 puede solucionar este problema. El identificador del parche es 5db74202d632306a883ccce7339c5bdba0d16c5a. Se recomienda actualizar el componente afectado.

17 Jun 2025, 06:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-06-17 06:15

Updated : 2025-06-17 20:50

NVD link : CVE-2025-6166

Mitre link : CVE-2025-6166

CVE.ORG link : CVE-2025-6166

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2025-6166", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 2.7, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 5.1, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.1}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-06-17T06:15:22.467", "references": [{"url": "https://github.com/frdel/agent-zero/commit/5db74202d632306a883ccce7339c5bdba0d16c5a", "source": "cna@vuldb.com"}, {"url": "https://github.com/frdel/agent-zero/issues/383", "source": "cna@vuldb.com"}, {"url": "https://github.com/frdel/agent-zero/issues/383#issuecomment-2893239897", "source": "cna@vuldb.com"}, {"url": "https://github.com/frdel/agent-zero/releases/tag/v0.8.4.1", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?ctiid.312641", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?id.312641", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?submit.593611", "source": "cna@vuldb.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in frdel Agent-Zero up to 0.8.4. It has been rated as problematic. This issue affects the function image_get of the file /python/api/image_get.py. The manipulation of the argument path leads to path traversal. Upgrading to version 0.8.4.1 is able to address this issue. The identifier of the patch is 5db74202d632306a883ccce7339c5bdba0d16c5a. It is recommended to upgrade the affected component."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en frdel Agent-Zero hasta la versi\u00f3n 0.8.4. Se ha clasificado como problem\u00e1tica. Este problema afecta a la funci\u00f3n image_get del archivo /python/api/image_get.py. La manipulaci\u00f3n del argumento path provoca un path traversal. Actualizar a la versi\u00f3n 0.8.4.1 puede solucionar este problema. El identificador del parche es 5db74202d632306a883ccce7339c5bdba0d16c5a. Se recomienda actualizar el componente afectado."}], "lastModified": "2025-06-17T20:50:23.507", "sourceIdentifier": "cna@vuldb.com"}