CVE-2024-8438: Path Traversal in modelscope/agentscope
A path traversal vulnerability exists in modelscope/agentscope version v.0.0.4. The API endpoint /api/file does not properly sanitize the path parameter, allowing an attacker to read arbitrary files on the server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8438?
CVE-2024-8438 has a moderate severity due to its potential to allow unauthorized access to sensitive files.
How do I fix CVE-2024-8438?
To fix CVE-2024-8438, upgrade the maliciously affected modelscope/agentscope package to a version that includes the patch for this vulnerability.
What kind of attack can CVE-2024-8438 enable?
CVE-2024-8438 can enable attackers to perform a path traversal attack, allowing them to read arbitrary files on the server.
Which versions of agentscope are affected by CVE-2024-8438?
CVE-2024-8438 affects agentscope version v.0.0.4 and earlier versions.
Is there a workaround for CVE-2024-8438?
A potential workaround for CVE-2024-8438 includes implementing proper input sanitization for the path parameter on the API endpoint.