Description
A vulnerability was found in composiohq composio up to 0.5.8 and classified as problematic. Affected by this issue is the function path of the file composio\server\api.py. The manipulation of the argument file leads to path traversal. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2024-09-15
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-2729 A vulnerability was found in composiohq composio up to 0.5.8 and classified as problematic. Affected by this issue is the function path of the file composio\server\api.py. The manipulation of the argument file leads to path traversal. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Github GHSA Github GHSA GHSA-66r2-xm28-74w9 Composio Path Traversal vulnerability
History

Sat, 12 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00387}

 epss

{'score': 0.00455}

Tue, 17 Sep 2024 11:15:00 +0000

Type Values Removed Values Added
First Time appeared Composio
Composio composio
CPEs cpe:2.3:a:composio:composio:*:*:*:*:*:*:*:*
Vendors & Products Composio
Composio composio

Tue, 17 Sep 2024 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Composiohq
Composiohq composio
CPEs cpe:2.3:a:composiohq:composio:*:*:*:*:*:*:*:*
Vendors & Products Composiohq
Composiohq composio
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 15 Sep 2024 01:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in composiohq composio up to 0.5.8 and classified as problematic. Affected by this issue is the function path of the file composio\server\api.py. The manipulation of the argument file leads to path traversal. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title composiohq composio api.py path path traversal
Weaknesses CWE-22
References
Metrics cvssV2_0

{'score': 2.7, 'vector': 'AV:A/AC:L/Au:S/C:P/I:N/A:N'}

cvssV3_0

{'score': 3.5, 'vector': 'CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Composio Composio
Composiohq Composio
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2024-09-16T20:19:08.269Z

Reserved: 2024-09-14T05:56:25.932Z

Link: CVE-2024-8865

cve-icon Vulnrichment

Updated: 2024-09-16T20:19:02.173Z

cve-icon NVD

Status : Analyzed

Published: 2024-09-15T01:15:10.423

Modified: 2024-09-17T10:50:37.580

Link: CVE-2024-8865

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses