-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability disclosure explicitly references the 'path' function in composio/server/api.py handling the 'file' argument. Analysis of the linked code shows the '_download_file_or_dir' endpoint (line 255) takes a 'file' parameter and uses it to construct Path() objects without validation. There is no check for directory traversal sequences or path normalization, enabling attackers to access arbitrary files by submitting paths like '../../etc/passwd'. The combination of direct user input usage in filesystem operations and lack of sanitization matches classic path traversal patterns.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| composio-core | pip | <= 0.5.8 |
PythonPythonOngoing coverage of React2Shell