The vulnerability in OpenBMB XAgent involves improper limitation of a pathname to a restricted directory, enabling path traversal attacks. Specifically, the workspace file endpoint accepts a `file_name` form field without validating or restricting parent-directory traversal sequences. Attackers can register accounts without email verification and exploit this flaw to read arbitrary files on the host, including critical system and application files outside the Docker container isolation.

Successful exploitation allows attackers with minimal privileges (self-registered or default-credential users) to read arbitrary files on the host system. This can lead to disclosure of sensitive data such as application secrets, database credentials, and system files, potentially compromising the confidentiality and security of the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict or monitor access to the workspace file endpoint and consider disabling self-registration or default credentials if possible.