CVE-2024-8551

critical · 9.1

A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope versions prior to the fix. This vulnerability allows an attacker to read and write arbitrary JSON files on the filesystem, potentially leading to the exposure or modification of sensitive information such as configuration files, API keys, and hardcoded passwords.

9.1

CVSS

1.0%

EPSS (exploit prob.)

60th

EPSS percentile

2025-03-20

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses

CWE-23

Affected products

Vendor	Product	Affected versions
modelscope	agentscope	all versions

Check a specific version with /api/v1/cve/match.

References

https://huntr.com/bounties/e0c0c294-f1e2-4f2c-a632-a9be9fd06989

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-8551