PT-2025-12253 · Composiohq · Composio

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-8958

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions composiohq/composio version 0.4.3

Description The issue is related to an unrestricted file write and read vulnerability in the filetools actions. This is due to improper validation of file paths, allowing an attacker to read and write files anywhere on the server. This could potentially lead to privilege escalation or remote code execution.

Recommendations For composiohq/composio version 0.4.3, consider restricting access to the filetools actions until a patch is available. As a temporary workaround, implement proper validation of file paths to prevent unauthorized file access.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-8958

Affected Products

Composio

References · 4

• 🔥 https://huntr.com/bounties/e152b094-0593-428e-b813-068d2390ce68 · Exploit
• https://osv.dev/vulnerability/CVE-2024-8958 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8958 · Security Note
• https://twitter.com/CVEnew/status/1902670999906304360 · Twitter Post