CVE-2024-8438highCWE-22

CVE-2024-8438: high-severity vulnerability in modelscope/agentscope

Path Traversal in modelscope/agentscope

Published

Follow this CVE+ Monitor modelscope/agentscope+ Monitor agentscope

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.8%
A path traversal vulnerability exists in modelscope/agentscope version v.0.0.4. The API endpoint `/api/file` does not properly sanitize the `path` parameter, allowing an attacker to read arbitrary files on the server.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
modelscope · modelscope/agentscope
Related CVEs — modelscope/agentscope

In the same product, most dangerous first.

CVE-2024-8502CRITICALRemote Code Execution via Deserialization in modelscope/agentscopeEPSS 1.8%CVE-2024-8524HIGHDirectory Traversal in modelscope/agentscopeEPSS 1.2%CVE-2024-8537CRITICALPath Traversal in modelscope/agentscopeEPSS 1.0%CVE-2024-8551CRITICALPath Traversal in modelscope/agentscopeEPSS 1.0%CVE-2024-8501HIGHArbitrary File Download in modelscope/agentscopeEPSS 1.0%CVE-2024-8550HIGHLocal File Inclusion (LFI) in modelscope/agentscopeEPSS 0.5%