CVE-2024-8865

Advisory

A security vulnerability affects the composiohq composio library. The vulnerability exists in the path function of the file composio\server\api.py. Attackers can manipulate the 'file' argument to achieve path traversal, potentially accessing unauthorized files on the system. This vulnerability has been publicly disclosed and exploits may exist in the wild.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/ComposioHQ/composio/blob/v0.5.8/python/composio/server/api.py#L255
• https://rumbling-slice-eb0.notion.site/There-is-an-arbitrary-file-read-vulnerability-at-api-download-in-composiohq-composio-f0ec1ec26a5f434a97bb1ffde435a35b
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8865