CVE-2025-6167

themanojdesai python-a2a api.py create_workflow path traversal

State: Published
Severity: 5.1 Medium
Published: Jun 17, 2025
Updated: Jun 17, 2025
Reserved: Jun 15, 2025

Description

A vulnerability classified as critical has been found in themanojdesai python-a2a up to 0.5.5. Affected is the function create_workflow of the file python_a2a/agent_flow/server/api.py. The manipulation leads to path traversal. Upgrading to version 0.5.6 is able to address this issue. It is recommended to upgrade the affected component.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X	VulDB
3.1	5.5 Medium	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C	VulDB
3.0	5.5 Medium	CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C	VulDB
2.0	5.2 Medium	AV:A/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C	VulDB

Weaknesses

CWE-22 Path Traversal

Affected Products

Product	Versions
python-a2athemanojdesai	0.5.0Affected 0.5.1Affected 0.5.2Affected 0.5.3Affected 0.5.4Affected 0.5.5Affected 0.5.6Not affected

References

VDB-312642 | themanojdesai python-a2a api.py create_workflow path traversalvdb-entrytechnical-description
VDB-312642 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #593613 | themanojdesai python-a2a < 0.5.6 Path Traversalthird-party-advisory
https://github.com/themanojdesai/python-a2a/issues/40issue-tracking
https://github.com/themanojdesai/python-a2a/issues/40#issuecomment-2904804388issue-tracking
https://github.com/themanojdesai/python-a2a/releases/tag/v0.5.6patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.