CVE-2025-6167: python-a2a has a path traversal in the create_workflow function
(updated )
A vulnerability classified as critical has been found in themanojdesai python-a2a up to 0.5.5. Affected is the function create_workflow of the file python_a2a/agent_flow/server/api.py. The manipulation leads to path traversal. Upgrading to version 0.5.6 is able to address this issue. It is recommended to upgrade the affected component.
References
- github.com/advisories/GHSA-rp38-pj7h-r8q2
- github.com/pypa/advisory-database/tree/main/vulns/python-a2a/PYSEC-2025-64.yaml
- github.com/themanojdesai/python-a2a
- github.com/themanojdesai/python-a2a/issues/40
- github.com/themanojdesai/python-a2a/issues/40
- github.com/themanojdesai/python-a2a/releases/tag/v0.5.6
- nvd.nist.gov/vuln/detail/CVE-2025-6167
- vuldb.com/?ctiid.312642
- vuldb.com/?id.312642
- vuldb.com/?submit.593613
Code Behaviors & Features
Detect and mitigate CVE-2025-6167 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →