CVE-2026-72713 debrief based on 7 supplied source links. XAgent contains a path traversal vulnerability in the workspace file endpoint that allows self-registered or default-credential users to read arbitrary files on the host by supplying parent-directory segments in the `file_name` form field with no path containment check. The vulnerability has a CVSS score of 8.7 and is considered HIGH severity. Defen [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-13T19:17:03.320Z and has not been modified since then. OpenBMB XAgent v1.0.0 and before is vulnerable to path traversal in the file() function in XAgent/XAgentServer/application/routers/workspace.py. The input parameter 'filename' is user-controllable and is concatenated into the file path to be rea [truncated]
