CVE-2026-82275: path traversal — HIGH

CISO Take

Qwen-Agent's document parser fails to validate file paths supplied to its Gradio-based interface, letting an unauthenticated caller pass an absolute path and read any file the server process can access. There's no login wall (PR:N, UI:N, AV:N) and exploitation is trivial (AC:L) — this is a single crafted request, not a research-grade attack, and CVSS 3.1 rates it 7.5 with confidentiality impact high and no integrity or availability loss. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so nothing indicates active mass exploitation today, but the low bar to weaponize means that can change fast once someone writes a one-liner. Any deployment exposing the Qwen-Agent Gradio document-parsing interface to a network — internal or external — should be treated as a credential and config leak risk, since agent deployments routinely keep API keys, service tokens, and system prompts on the same filesystem the server process can read. Upgrade past 0.0.34 immediately, and until patched, restrict network access to the Gradio interface (auth proxy, VPN, or firewall) and audit access logs for absolute-path or directory-traversal patterns in document-parse requests.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

High-severity, low-effort vulnerability: unauthenticated, network-reachable, zero user interaction, and no privileges required. The only mitigating factor against real-world urgency is the absence of confirmed active exploitation (no KEV entry, no EPSS data, no public PoC or Nuclei template) and the fact that impact is limited to confidentiality (arbitrary file read) rather than code execution or data tampering. However, path traversal bugs in AI tooling are frequently and quickly weaponized once disclosed because the exploitation pattern (supply an absolute or `../`-laden path) is trivial to automate. Any organization running Qwen-Agent's Gradio document-parsing UI on a reachable network segment should treat this as urgent-to-patch, not wait-and-see.

How does the attack unfold?

Initial Access

Attacker reaches Qwen-Agent's unauthenticated Gradio document-parsing interface over the network with no credentials or user interaction required.

AML.T0049

Exploitation

Attacker submits an absolute file path instead of a legitimate document, bypassing the parser's intended directory restriction (CWE-22 path traversal).

AML.T0037

Impact

The server reads and returns the contents of the targeted file, exposing credentials, configuration, or other sensitive data accessible to the Qwen-Agent process.

Initial Access

Attacker reaches Qwen-Agent's unauthenticated Gradio document-parsing interface over the network with no credentials or user interaction required.

AML.T0049

Exploitation

Attacker submits an absolute file path instead of a legitimate document, bypassing the parser's intended directory restriction (CWE-22 path traversal).

AML.T0037

Impact

The server reads and returns the contents of the targeted file, exposing credentials, configuration, or other sensitive data accessible to the Qwen-Agent process.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 46% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

1 step

1) Upgrade Qwen-Agent beyond the affected 0.0.34 range as soon as a patched release is available (track github.com/QwenLM/Qwen-Agent and the linked issue #912). 2) Until patched, do not expose the Gradio document-parser interface directly to untrusted networks — place it behind authentication, a VPN, or an authenticated reverse proxy. 3) Apply the principle of least privilege to the service account running Qwen-Agent so that even a successful traversal only exposes non-sensitive files (no co-located credentials, keys, or .env files). 4) Add input validation/allowlisting at the network edge or WAF layer to reject absolute paths or ../ sequences in document-parse request parameters as a stop-gap. 5) Monitor access logs and application logs for anomalous file-path parameters or repeated parser errors indicating traversal attempts.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data ExtractionData LeakageAgentPluginAML.T0037- Data from Local System AML.T0049- Exploit Public-Facing Application AML.T0084- Discover AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.6-AI system security and resilience evaluation

OWASP LLM Top 10

LLM02-Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-82275?

Qwen-Agent's document parser fails to validate file paths supplied to its Gradio-based interface, letting an unauthenticated caller pass an absolute path and read any file the server process can access. There's no login wall (PR:N, UI:N, AV:N) and exploitation is trivial (AC:L) — this is a single crafted request, not a research-grade attack, and CVSS 3.1 rates it 7.5 with confidentiality impact high and no integrity or availability loss. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so nothing indicates active mass exploitation today, but the low bar to weaponize means that can change fast once someone writes a one-liner. Any deployment exposing the Qwen-Agent Gradio document-parsing interface to a network — internal or external — should be treated as a credential and config leak risk, since agent deployments routinely keep API keys, service tokens, and system prompts on the same filesystem the server process can read. Upgrade past 0.0.34 immediately, and until patched, restrict network access to the Gradio interface (auth proxy, VPN, or firewall) and audit access logs for absolute-path or directory-traversal patterns in document-parse requests.

Is CVE-2026-82275 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-82275, increasing the risk of exploitation.

How to fix CVE-2026-82275?

1) Upgrade Qwen-Agent beyond the affected 0.0.34 range as soon as a patched release is available (track github.com/QwenLM/Qwen-Agent and the linked issue #912). 2) Until patched, do not expose the Gradio document-parser interface directly to untrusted networks — place it behind authentication, a VPN, or an authenticated reverse proxy. 3) Apply the principle of least privilege to the service account running Qwen-Agent so that even a successful traversal only exposes non-sensitive files (no co-located credentials, keys, or `.env` files). 4) Add input validation/allowlisting at the network edge or WAF layer to reject absolute paths or `../` sequences in document-parse request parameters as a stop-gap. 5) Monitor access logs and application logs for anomalous file-path parameters or repeated parser errors indicating traversal attempts.

What systems are affected by CVE-2026-82275?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, model serving.

What is the CVSS score for CVE-2026-82275?

CVE-2026-82275 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.55%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesmodel serving

MITRE ATLAS Techniques

AML.T0037Data from Local System

AML.T0049Exploit Public-Facing Application

AML.T0084Discover AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.6

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that fails to restrict file access to intended directories. Attackers can supply absolute file paths to the unauthenticated Gradio interface to read arbitrary files accessible by the server process.

Exploitation Scenario

An attacker discovers a Qwen-Agent instance with its Gradio document-parsing interface reachable on the internet or an internal network. Without authenticating, they submit a document-parse request where the file path parameter is set to an absolute path such as a systemwide credentials file or the application's own `.env` configuration instead of an uploaded document. The unsanitized parser reads the file content directly and returns it in the parsed-document response, handing the attacker plaintext secrets, API keys, or other sensitive files accessible to the server process — which they can then use to pivot into connected AI services, cloud accounts, or the broader agent infrastructure.

Weaknesses (CWE)

CWE-22Improper Limitation of a Pathname to a Restricted DirectoryPrimary CWE-22Improper Limitation of a Pathname to a Restricted Directory

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.