Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai
CVE-2024-8958Unrestricted File Write and Read in composiohq/composio
High 7.2
In plain English
A high-severity unrestricted file upload in composiohq/composio from composiohq. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities).
Severity (CVSS 3.0)7.2High
Exploit odds (30 days)1.4%top 27.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
In composiohq/composio version 0.4.3, there is an unrestricted file write and read vulnerability in the filetools actions. Due to improper validation of file paths, an attacker can read and write files anywhere on the server, potentially leading to privilege escalation or remote code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| composiohq | composiohq/composio | unspecified – through latest |
Weakness: CWE-434 · Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H