What’s Vulnerable › Vulnerabilities

CVE-2025-6166: frdel Agent-Zero image_get.py image_get path traversal

• Severity: low (CVSS 3.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-06-17 · updated 2026-06-17
• Weakness: CWE-22

Description

A vulnerability was found in frdel Agent-Zero up to 0.8.4. It has been rated as problematic. This issue affects the function image_get of the file /python/api/image_get.py. The manipulation of the argument path leads to path traversal. Upgrading to version 0.8.4.1 is able to address this issue. The identifier of the patch is 5db74202d632306a883ccce7339c5bdba0d16c5a. It is recommended to upgrade the affected component.

Affected products

• frdel agent-zero: before 0.8.4.1 — fixed in 0.8.4.1

How to fix

Upgrade to a fixed version: frdel agent-zero 0.8.4.1. Check the vendor advisory for mitigations.

References

• https://github.com/frdel/agent-zero/commit/5db74202d632306a883ccce7339c5bdba0d16c5a
• https://github.com/frdel/agent-zero/issues/383
• https://github.com/frdel/agent-zero/issues/383#issuecomment-2893239897
• https://github.com/frdel/agent-zero/releases/tag/v0.8.4.1
• https://vuldb.com/?ctiid.312641
• https://vuldb.com/?id.312641
• https://vuldb.com/?submit.593611

Get alerted when CVE-2025-6166 or the next vulnerability affects your stack