Advisoriesby IbisagentscopeGHSA-f4hc-q562-cc5r
AgentScope Path Traversal in /api/file
No fix yet
A path traversal vulnerability exists in modelscope/agentscope version v.0.0.4. The API endpoint /api/file does not properly sanitize the path parameter, allowing an attacker to read arbitrary files on the server.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| agentscope PyPI | <= 0.0.4 | No fix yet |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-22
- Also known as
- CVE-2024-8438, PYSEC-2025-80
- nvd.nist.gov/vuln/detail/CVE-2024-8438
- github.com/modelscope/agentscope
- github.com/modelscope/agentscope/blob/af8e45ded37b3834c981473b309239e0102473d0/src/agentscope/studio/_app.py#L578
- github.com/pypa/advisory-database/tree/main/vulns/agentscope/PYSEC-2025-80.yaml
- huntr.com/bounties/3f170c58-42ee-422d-ab6f-32c7aa05b974
More agentscope advisories
All agentscope
AgentScope stored cross-site scripting (XSS) vulnerabilityCVE-2024-8556no fix yetAgentScope directory traversal vulnerability in /read-examplesCVE-2024-8524no fix yetAgentScope Cross-Origin Resource Sharing (CORS) vulnerabilityCVE-2024-8487no fix yetAgentScope Deserialization VulnerabilityCVE-2024-8502no fix yetAgentScope path traversal vulnerabilityCVE-2024-8537no fix yetAgentScope path traversal vulnerability in save-workflowCVE-2024-8551no fix yet