{"data":{"id":"34eeabcd-462d-43b9-b803-043374ea6636","title":"CVE-2026-82275: Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that fails to restrict file acc","summary":"Qwen-Agent versions up to 0.0.34 have a path traversal vulnerability (a flaw that lets attackers access files outside the intended directory) in its document parser. Attackers can use the unprotected Gradio interface (a web tool for sharing AI models) to read any files that the server has access to by providing file paths.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82275","publishedAt":"2026-08-28T20:20:18.507Z","cveId":"CVE-2026-82275","cweIds":["CWE-22"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":[],"affectedVendorsRaw":["Qwen-Agent","Alibaba"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"patchAvailable":null,"disclosureDate":"2026-08-28T20:20:18.507Z","capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.92,"researchCategory":null,"atlasIds":null}}