CVE-2024-8537

critical · 9.1

A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. The vulnerability is present in the /delete-workflow endpoint, allowing an attacker to delete arbitrary files from the filesystem. This issue arises due to improper input validation, enabling the attacker to manipulate file paths and delete sensitive files outside of the intended directory.

9.1

CVSS

1.0%

EPSS (exploit prob.)

61st

EPSS percentile

2025-03-20

Published

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weaknesses

CWE-29

Affected products

Vendor	Product	Affected versions
modelscope	agentscope	all versions

Check a specific version with /api/v1/cve/match.

References

https://huntr.com/bounties/eeb8aa4b-e6e5-465c-b0dd-aa97e3b7dc09

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-8537