CVE-2025-6167

Katalog CVE

CVSS 9.8 · Critical EPSS 0,86%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada themanojdesai python a2a. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A vulnerability classified as critical has been found in themanojdesai python-a2a up to 0.5.5. Affected is the function create_workflow of the file python_a2a/agent_flow/server/api.py. The manipulation leads to path traversal. Upgrading to version 0.5.6 is able to address this issue. It is recommended to upgrade the affected component.

Rincian

Terbit di NVD

17 Juni 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,86% peluang dieksploitasi; lebih tinggi dari 57,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://vuldb.com/?id.312642 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.593613 advisory pihak ketiga · vdb entry
• https://github.com/themanojdesai/python-a2a/issues/40 exploit · issue tracking
• https://github.com/themanojdesai/python-a2a/issues/40#issuecomment-2904804388 exploit · issue tracking
• https://github.com/themanojdesai/python-a2a/releases/tag/v0.5.6 release notes
• https://vuldb.com/?ctiid.312642 permissions required · vdb entry