VULNERABILITY INTELLIGENCE

CVE-2024-8550

CVSS score7.5 HIGH
EPSS probability0.52%
CISA KEVNot currently listed
Published2025-02-10
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

A Local File Inclusion (LFI) vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. This vulnerability allows an attacker to read arbitrary files from the server, including sensitive files such as API keys, by manipulating the filename parameter. The issue arises due to improper sanitization of user input passed to the os.path.join function, which can be exploited to access files outside the intended directory.

Weakness classification

  • CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Primary references