PT-2025-49045 · Unknown · Composiohq

Published 2025-12-04 · Updated 2025-12-09 · CVE-2025-56427

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ComposioHQ version 0.7.20

Description A directory traversal issue exists in ComposioHQ version 0.7.20. This allows a remote attacker to potentially access sensitive information through the download file or dir function. The issue involves improper handling of file paths, potentially allowing access to files outside the intended directory.

Recommendations Update ComposioHQ to a newer version that addresses this issue. As a temporary workaround, restrict access to the download file or dir function until a patch is available.

Exploit

Fix

Path traversal

Information Disclosure

Weakness Enumeration

CWE-22

CWE-200

Related Identifiers

CVE-2025-56427

GHSA-3MWV-J45G-VP3W

Affected Products

Composiohq

References · 8

• 🔥 https://github.com/TOAST-Research/pocs/blob/main/composio/composio_1.md · Exploit
• https://osv.dev/vulnerability/GHSA-3mwv-j45g-vp3w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-56427 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-56427 · Security Note
• https://github.com/ComposioHQ/composio/blob/master/python/composio/server/api.py#L278 · Note
• https://github.com/ComposioHQ/composio · Note
• https://twitter.com/cracbot/status/1998346953151922466 · Twitter Post
• https://twitter.com/CVEnew/status/1996600335570231658 · Twitter Post