Relative Path Traversal
CVE-2024-8551
Summary
A path traversal vulnerability exists in the "save-workflow" and "load-workflow" functionalities of modelscope/agentscope. This vulnerability allows an attacker to read and write arbitrary JSON files on the filesystem, potentially exposing or modifying sensitive information such as configuration files, API keys, and hardcoded passwords. This issue affects agentscope versions 0.1.0 and after.
- LOW
- NETWORK
- HIGH
- UNCHANGED
- NONE
- NONE
- HIGH
- NONE
CWE-23 - Relative Path Traversal
The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
References
Advisory Timeline
- Published
