CVE-2026-79407: Path Traversal
A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the FILENAME value used by setfilename() and loadmetadata() in metagpt/ext/spo/utils/load.py. The vulnerable code joins the attacker-controlled FILENAME value with the settings directory and opens the resulting path without validating that the resolved path remains within the intended directory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
metagpt/ext/spoto a version that resolves this vulnerability.Fixed in 0.8.1
Event History
Frequently Asked Questions
Which deployments are exposed?
MetaGPT 0.8.1 deployments using the SPO extension are affected when an attacker can influence the FILE_NAME value passed to set_file_name() or load_meta_data().
What does an attacker need to exploit this issue?
The attacker needs control over the FILE_NAME value used by the affected functions. The vulnerable code uses that value when constructing a path and does not verify that the resolved path remains inside the settings directory.
What is the potential impact?
An attacker can use path traversal through FILE_NAME to read arbitrary files accessible to the MetaGPT process.