Critical severity · published Mar 20, 2025
CVE-2024-8958
Unrestricted File Write and Read in composiohq/composio
9.8
CVSS
1.4%
EPSS
No
On KEV
Description
In composiohq/composio version 0.4.3, there is an unrestricted file write and read vulnerability in the filetools actions. Due to improper validation of file paths, an attacker can read and write files anywhere on the server, potentially leading to privilege escalation or remote code execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
composiohq/composio · composiohq
through latest · source: vendor
CO
Composio · Composio
0.4.3 · source: NVD
Affected product
CO
composiohq/composio
composiohq
More from composiohq/composio
9.8
CVE-2024-8953
Unsafe eval usage in composiohq/composio
9.8
CVE-2024-8954
Authentication Bypass in composiohq/composio
7.5
CVE-2024-8952
SSRF in composiohq/composio
7.5
CVE-2024-8955
SSRF in composiohq/composio