CVE-2025-6283 is a path traversal vulnerability affecting xataio Xata Agent versions up to 0.3.0, specifically within the GET function of the apps/dbagent/src/app/api/evals/route.ts file. This high-severity vulnerability (CVSS 7.5) allows an unauthenticated attacker to access arbitrary files on the system due to improper handling of arguments, leading to potential data exposure. While no active exploitation, public exploit code, or significant community discussion has been observed, immediate upgrade to version 0.3.1 is strongly recommended to mitigate this risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 0.3.1CPE matchmatch criteria | cpe:2.3:a:xata:agent:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.