CyberRota Analysis
AI-GeneratedThe vulnerability in Qwen-Agent allows attackers to exploit a path traversal flaw in the document parser, enabling them to access arbitrary files on the server through the unauthenticated Gradio interface. This could lead to unauthorized data exposure, posing a significant risk to sensitive information. Organizations using affected versions should prioritize remediation to mitigate potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that fails to restrict file access to intended directories. Attackers can supply absolute file paths to the unauthenticated Gradio interface to read arbitrary files accessible by the server process.