CVE-2025-6167 themanojdesai python-a2a api.py create_workflow path traversal
An attacker can exploit a path traversal vulnerability in the python-a2a library to read or modify arbitrary files on the server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-6167?
CVE-2025-6167 is a medium-severity path traversal vulnerability in themanojdesai python-a2a, published on 17 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability classified as critical has been found in themanojdesai python-a2a up to 0.5.5. Affected is the function create_workflow of the file python_a2a/agent_flow/server/api.py. The manipulation leads to path traversal. Upgrading to version 0.5.6 is able to address this issue. It is recommended to upgrade the affected component.
Weakness: CWE-22
Which versions are affected by CVE-2025-6167?
3 open source packages ship an affected version, including python-a2a. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
python-a2a PyPI | All versions | 0.5.6 |
python-a2a PyPI | All versions | 0.5.6 |
python-a2a PyPI | All versions | 0.5.6 |
Products include Themanojdesai Python A2a.
How do I fix CVE-2025-6167?
Upgrade python-a2a to 0.5.6 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-6167 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-6167 exists.
Sources
Also known as GHSA-rp38-pj7h-r8q2, PYSEC-2025-64.