CVE-2025-6283 MEDIUM

CVE-2025-6283: xataio Xata Agent route.ts GET path traversal

Vendor Xataio
Product Xata Agent
Weakness CWE-22 · Path traversal
Published June 19, 2025
Last update June 23, 2025
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Adjacent
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X

What the vulnerability does

01Description

A vulnerability was found in xataio Xata Agent up to 0.3.0. It has been classified as problematic. This affects the function GET of the file apps/dbagent/src/app/api/evals/route.ts. The manipulation of the argument passed leads to path traversal. Upgrading to version 0.3.1 is able to address this issue. The patch is named 03f27055e0cf5d4fa7e874d34ce8c74c7b9086cc. It is recommended to upgrade the affected component.

Key dates

02Disclosure timeline

June 19, 2025 CVE published
June 23, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-13503 antlr ANTLR4 tokenVocab Grammar Option TokenVocabParser.java getImportedVocabFile path traversal CVE-2026-55607 Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution CVE-2026-11367 PixMagix <= 1.7.2 - Authenticated (Author+) Path Traversal in 'layers[].id' Parameter CVE-2026-13251 Perfmatters <= 2.6.4 - Unauthenticated Arbitrary File Read via 's' Parameter CVE-2026-8811 Path traversal in PDF generation module