Login Request a demo
High severity · published Aug 28, 2026
CVE-2026-82275
Qwen-Agent Arbitrary File Read via Caller-Supplied Document Path
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that fails to restrict file access to intended directories. Attackers can supply absolute file paths to the unauthenticated Gradio interface to read arbitrary files accessible by the server process.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QW
Qwen-Agent · QwenLM
through 0.0.34 · source: vendor
Affected product
QW
Qwen-Agent
QwenLM
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-82275
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-82275
github.com
https://github.com/QwenLM/Qwen-Agent
github.com
https://github.com/QwenLM/Qwen-Agent/blob/31a4d36d123688581a9e9744427272b33ce940e0/qwen_agent/tools/simple_doc_parser.py
github.com
https://github.com/QwenLM/Qwen-Agent/blob/31a4d36d123688581a9e9744427272b33ce940e0/qwen_agent/utils/utils.py
github.com
https://github.com/QwenLM/Qwen-Agent/issues/912
www.vulncheck.com
https://www.vulncheck.com/advisories/qwen-agent-arbitrary-file-read-via-caller-supplied-document-path
More from Qwen-Agent
7.5
CVE-2026-82268
Qwen-Agent Server-Side Request Forgery via Caller-Supplied Document URL