OpenBMB XAgent version 1.0.0 contains a directory traversal vulnerability in the main-upload_file function located in ToolServer/ToolServerNode/main.py at line 46. This vulnerability could allow an attacker to access files outside the intended directory structure.