CVE-2025-67076
Published: 15 January 2026
Summary
CVE-2025-67076 is a high-severity Path Traversal (CWE-22) vulnerability in Agora-Project Agora-Project. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AU-13 (Monitoring for Information Disclosure).
Deeper analysis
CVE-2025-67076 is a directory traversal vulnerability (CWE-22) in the Omnispace Agora Project versions before 25.10. The issue affects the misc controller, specifically the ExternalGetFile action, which allows unauthenticated attackers to read arbitrary files on the affected system. Exploitation is limited to files that have an extension.
Unauthenticated attackers can exploit this vulnerability remotely over the network (AV:N) with low attack complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N). Successful exploitation results in high confidentiality impact (C:H) by disclosing sensitive file contents, while integrity (I:N) and availability (A:N) remain unaffected under an unchanged scope (S:U), yielding a CVSS v3.1 base score of 7.5.
Mitigation details and advisories are available from the Agora Project website at https://www.agora-project.net and the Helx.io security advisory at https://www.helx.io/blog/advisory-agora-project/. The vulnerability was published on 2026-01-15.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2762
Vulnerability details
Directory traversal vulnerability in Omnispace Agora Project before 25.10 allowing unauthenticated attackers to read files on the system via the misc controller and the ExternalGetFile action. Only files with an extension can be read.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directory traversal in public-facing web app enables remote unauthenticated file read (T1190); directly facilitates arbitrary local file content disclosure (T1005).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Validates inputs to the ExternalGetFile action in the misc controller to reject directory traversal sequences like '../', preventing unauthorized file reads.
Enforces approved access authorizations in the application to restrict unauthenticated file access to only permitted paths and resources, blocking traversal exploits.
Monitors audit logs and system alerts for unauthorized disclosures via the ExternalGetFile action, identifying directory traversal attempts and information leaks.