QwenLM vulnerabilities
We track 2 vulnerabilities in QwenLM products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on August 28, 2026.
2vulnerabilities
0critical
2high
0exploited
7.5average CVSS score
Latest QwenLM vulnerabilities
- 7.5 High severity
Qwen-Agent: Improper Limitation of a Pathname to a Restricted Directory
Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that fails to restrict file access to intended directories. Attackers can supply absolute file paths to the unauthenticated Gradio interface to read arbitrary files access
- 7.5 High severity
Qwen-Agent: Server-Side Request Forgery
Qwen-Agent through 0.0.34 contains a server-side request forgery vulnerability in the document parsing path that treats caller-supplied paths as URLs without scheme restriction or host validation. Attackers can reach the unauthenticated Gradio interface to mak