Base Score

LOW3.5

CVE-2025-55523

An issue in the component /api/download_work_dir_file.py of Agent-Zero v0.8.* allows attackers to execute a directory traversal.

VectorADJACENT_NETWORK

Published Bycve@mitre.org

Published DateAug 21, 2025, 18:15

Weakness Type (CWE):CWE-22

CVSS Metrics

Base Score

3.5

Vector String

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Base Severity

LOW

Version

3.1

Attack Vector (AV)

ADJACENT_NETWORK

Attack Complexity (AC)

LOW

Privileges Required (PR)

LOW

User Interaction (UI)

NONE

Scope (S)

UNCHANGED

Confidentiality (C)

LOW

Integrity (I)

NONE

Availability (A)

NONE

References

https://github.com/agent0ai/agent-zero/issues/687
https://github.com/frdel/agent-zero/blob/v0.8.7/python/api/download_work_dir_file.py
https://www.cve.org/CVERecord?id=CVE-2025-6166

Base Score

LOW3.5

Weakness Type (CWE):CWE-22

CVSS Metrics

Base Score

3.5

Vector String

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Base Severity

LOW

Version

3.1

Attack Vector (AV)

ADJACENT_NETWORK

Attack Complexity (AC)

LOW

Privileges Required (PR)

LOW

User Interaction (UI)

NONE

Scope (S)

UNCHANGED

Confidentiality (C)

LOW

Integrity (I)

NONE

Availability (A)

NONE