CVE-2024-8537: AgentScope path traversal vulnerability
A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. The vulnerability is present in the /delete-workflow endpoint, allowing an attacker to delete arbitrary files from the filesystem. This issue arises due to improper input validation, enabling the attacker to manipulate file paths and delete sensitive files outside of the intended directory.
Published Mar 20, 2025
Affected packages
agentscope
- Ecosystem
- PyPI
- Affected
- <= 0.1.1
- Fixed in
- No patched version yet
- Check
pip show agentscope
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. The vulnerability is present in the /delete-workflow endpoint, allowing an attacker to delete arbitrary files from the filesystem. This issue arises due to improper input validation, enabling the attacker to manipulate file paths and delete sensitive files outside of the intended directory.
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-8537
- https://huntr.com/bounties/eeb8aa4b-e6e5-465c-b0dd-aa97e3b7dc09
- https://github.com/modelscope/agentscope/pull/459
- https://github.com/modelscope/agentscope/commit/7d285e862f86fa1d96ed04c4cd40a5f1b8f9189a
- https://github.com/modelscope/agentscope/blob/01530ee6a99c86426aab1be11ec3b3b86ca640ac/src/agentscope/studio/_app.py#L743
- https://github.com/advisories/GHSA-c4cc-w454-4634
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology