frdel Agent-Zero image_get.py image_get path traversal

The Path Traversal vulnerability in Agent-Zero allows an attacker to bypass intended access controls and read arbitrary files on the system where Agent-Zero is running. By crafting a malicious request that manipulates the 'path' parameter in the /python/api/image_get.py endpoint, an attacker could potentially retrieve configuration files, source code, or other sensitive data. The extent of the data accessible depends on the permissions of the Agent-Zero process and the file system structure. While the CVSS score is LOW, successful exploitation could lead to information disclosure and compromise system confidentiality.

Organizations deploying Agent-Zero versions 0.8.0 through 0.8.4.1 are at risk. This includes environments where Agent-Zero is used for image processing or data retrieval, particularly those with publicly accessible API endpoints. Shared hosting environments where Agent-Zero is installed could also be vulnerable if the hosting provider has not applied the update.

• python / server:

import requests
import os

url = 'http://your-agent-zero-server/python/api/image_get.py'

try:
    response = requests.get(url, params={'path': '../etc/passwd'}) # Attempt path traversal
    if response.status_code == 200:
        print("Potential vulnerability detected: Path traversal successful.")
    else:
        print("Path traversal attempt failed.")
except requests.exceptions.RequestException as e:
    print(f"Error: {e}")

1. 2025-06-17Disclosure

   disclosure

1. Reserviert2025-06-15
2. Veröffentlicht2025-06-17
3. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-6166 is to upgrade Agent-Zero to version 0.8.4.1 or later, which includes the fix. If an immediate upgrade is not feasible, consider implementing input validation on the 'path' parameter within the /python/api/imageget.py endpoint to prevent path traversal attempts. This could involve whitelisting allowed characters or restricting the path to a specific directory. Additionally, review file system permissions to ensure that the Agent-Zero process has only the necessary access rights. After upgrading, confirm the fix by attempting to access a restricted file via the /python/api/imageget.py endpoint with a crafted path traversal payload; access should be denied.