Skip to main content

Path Traversal: '\..\filename'

CVE-2024-8537

High
9.1/10

Summary

A Path Traversal vulnerability exists in the modelscope/agentscope application. The vulnerability is present in the "/delete-workflow" endpoint, allowing an attacker to delete arbitrary files from the filesystem. This issue arises due to Improper Input Validation, enabling the attacker to manipulate file paths and delete sensitive files outside of the intended directory. This issue affects agentscope versions prior to 0.1.2.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-29 - Path Traversal: '\..\filename'

The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.

References

Advisory Timeline

  • Published