CyberRota Analysis
AI-GeneratedA server-side request forgery vulnerability in Qwen-Agent allows attackers to exploit the document parsing functionality, treating user-supplied paths as URLs without proper validation. This can lead to unauthorized access to internal services, including sensitive metadata, by making the server issue HTTP requests to arbitrary internal addresses. Organizations utilizing Qwen-Agent should prioritize immediate remediation to mitigate the risk of data exposure and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Qwen-Agent through 0.0.34 contains a server-side request forgery vulnerability in the document parsing path that treats caller-supplied paths as URLs without scheme restriction or host validation. Attackers can reach the unauthenticated Gradio interface to make the server issue HTTP requests to arbitrary internal addresses including metadata services and read retrieved content through parsed document output.