CVE-2024-8958

critical · 9.8

In composiohq/composio version 0.4.3, there is an unrestricted file write and read vulnerability in the filetools actions. Due to improper validation of file paths, an attacker can read and write files anywhere on the server, potentially leading to privilege escalation or remote code execution.

9.8

CVSS

1.4%

EPSS (exploit prob.)

71st

EPSS percentile

2025-03-20

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-434

Affected products

Vendor	Product	Affected versions
composio	composio	0.4.3

Check a specific version with /api/v1/cve/match.

References

https://huntr.com/bounties/e152b094-0593-428e-b813-068d2390ce68
https://huntr.com/bounties/e152b094-0593-428e-b813-068d2390ce68

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-8958