CVE-2024-8865

Advisory

A critical security vulnerability affects the composiohq composio library. The vulnerability exists in the path function of the file composio\server\api.py. Attackers can manipulate the 'file' argument to achieve path traversal, potentially accessing unauthorized files on the system. This vulnerability has been publicly disclosed and exploits may exist in the wild. The vendor has not responded to disclosure attempts, underscoring the urgency of this update. Never process file paths from untrusted sources without proper sanitization and validation.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/ComposioHQ/composio/blob/v0.5.8/python/composio/server/api.py#L255
• https://rumbling-slice-eb0.notion.site/There-is-an-arbitrary-file-read-vulnerability-at-api-download-in-composiohq-composio-f0ec1ec26a5f434a97bb1ffde435a35b
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8865