CVE-2025-6166

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-6166
A vulnerability was found in frdel Agent-Zero up to 0.8.4. It has been rated as problematic. This issue affects the function image_get of the file /python/api/image_get.py. The manipulation of the argument path leads to path traversal. Upgrading to version 0.8.4.1 is able to address this issue. The identifier of the patch is 5db74202d632306a883ccce7339c5bdba0d16c5a. It is recommended to upgrade the affected component.

3.5 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 1.4

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.7 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:A/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 5.1 / Impact : 2.9

Access Vector ADJACENT_NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://github.com/frdel/agent-zero/commit/5db74202d632306a883ccce7339c5bdba0d16c5a Patch
https://github.com/frdel/agent-zero/issues/383 Exploit Issue Tracking Vendor Advisory
https://github.com/frdel/agent-zero/issues/383#issuecomment-2893239897 Issue Tracking
https://github.com/frdel/agent-zero/releases/tag/v0.8.4.1 Release Notes
https://vuldb.com/?ctiid.312641 Permissions Required VDB Entry
https://vuldb.com/?id.312641 Third Party Advisory VDB Entry
https://vuldb.com/?submit.593611 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:agent-zero:agent-zero:*:*:*:*:*:*:*:*
History

08 Jan 2026, 14:46

Type Values Removed Values Added
References () https://github.com/frdel/agent-zero/commit/5db74202d632306a883ccce7339c5bdba0d16c5a - () https://github.com/frdel/agent-zero/commit/5db74202d632306a883ccce7339c5bdba0d16c5a - Patch
References () https://github.com/frdel/agent-zero/issues/383 - () https://github.com/frdel/agent-zero/issues/383 - Exploit, Issue Tracking, Vendor Advisory
References () https://github.com/frdel/agent-zero/issues/383#issuecomment-2893239897 - () https://github.com/frdel/agent-zero/issues/383#issuecomment-2893239897 - Issue Tracking
References () https://github.com/frdel/agent-zero/releases/tag/v0.8.4.1 - () https://github.com/frdel/agent-zero/releases/tag/v0.8.4.1 - Release Notes
References () https://vuldb.com/?ctiid.312641 - () https://vuldb.com/?ctiid.312641 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.312641 - () https://vuldb.com/?id.312641 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.593611 - () https://vuldb.com/?submit.593611 - Third Party Advisory, VDB Entry
CPE cpe:2.3:a:agent-zero:agent-zero:*:*:*:*:*:*:*:*
First Time Agent-zero agent-zero
Agent-zero

17 Jun 2025, 20:50

Type Values Removed Values Added
Summary
  • (es) Se encontró una vulnerabilidad en frdel Agent-Zero hasta la versión 0.8.4. Se ha clasificado como problemática. Este problema afecta a la función image_get del archivo /python/api/image_get.py. La manipulación del argumento path provoca un path traversal. Actualizar a la versión 0.8.4.1 puede solucionar este problema. El identificador del parche es 5db74202d632306a883ccce7339c5bdba0d16c5a. Se recomienda actualizar el componente afectado.

17 Jun 2025, 06:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-17 06:15

Updated : 2026-01-08 14:46

NVD link : CVE-2025-6166

Mitre link : CVE-2025-6166

CVE.ORG link : CVE-2025-6166

JSON object : View

Products Affected

agent-zero

  • agent-zero
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')