agentscopePYSEC-2025-84
A Local File Inclusion (LFI) vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. This vulnerability allows an attacker to read arbitrary files from the server, including sensitive files such as API keys, by manipulating the filename parameter. The issue arise
High7.5CVE-2024-8550 · Published Feb 10, 2025 · updated May 21, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| agentscope PyPI | <= 0.0.4 | No fix yet |
Details and references
A Local File Inclusion (LFI) vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. This vulnerability allows an attacker to read arbitrary files from the server, including sensitive files such as API keys, by manipulating the filename parameter. The issue arises due to improper sanitization of user input passed to the os.path.join function, which can be exploited to access files outside the intended directory.
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Severity from
- the CVSS score
- Also known as
- CVE-2024-8550
More agentscope advisories
All| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 202025 | AgentScope stored cross-site scripting (XSS) vulnerability CVE-2024-8556Medium6.1no fix yet | Medium6.1 | No fix yet |
| Mar 202025 | AgentScope directory traversal vulnerability in /read-examples CVE-2024-8524High7.5no fix yet | High7.5 | No fix yet |
| Mar 202025 | AgentScope Cross-Origin Resource Sharing (CORS) vulnerability CVE-2024-8487High7.4no fix yet | High7.4 | No fix yet |
| Mar 202025 | AgentScope Deserialization Vulnerability CVE-2024-8502Critical9.8no fix yet | Critical9.8 | No fix yet |
| Mar 202025 | AgentScope path traversal vulnerability CVE-2024-8537Critical9.1no fix yet | Critical9.1 | No fix yet |
| Mar 202025 | AgentScope Path Traversal in /api/file CVE-2024-8438High7.5no fix yet | High7.5 | No fix yet |