CVE-2026-26396 describes a directory traversal vulnerability in OpenBMB XAgent v1.0.0 and prior. The issue exists in the file() function within XAgent/XAgentServer/application/routers/workspace.py, where the 'filename' input parameter is directly concatenated into a file path without validation. This allows attackers to traverse directories and read arbitrary files, leading to potential sensitive information disclosure. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). There is no vendor advisory or patch information available at this time.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive files on the affected system. The vulnerability does not impact integrity or availability but poses a confidentiality risk. The CVSS 3.1 base score is 7.5 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable service and validate or sanitize input parameters where possible to mitigate exploitation risk.