A path traversal flaw in the SPO extension of MetaGPT 0.8.1 permits an attacker to read files outside the intended settings directory. The code constructs a file path by combining an attacker‑supplied FILE_NAME value with the server’s configuration directory and then opens the resulting file without verifying that the resolved path remains inside that directory. If exploited, the adversary can access any file that the process can read, including configuration files, credentials, or other sensitive data, leading to disclosure of confidential information and potential further compromise of the host system.

The vulnerability exists in MetaGPT 0.8.1, specifically within the SPO extension, where the set_file_name() and load_meta_data() functions in metagpt/ext/spo/utils/load.py are affected. No additional vendor or product versions are identified.

Because the code accepts a user‑controlled file name, an attacker who can trigger the load_meta_data() routine—such as through an API request or user interface—can craft a path like "../../../../etc/passwd" to read arbitrary files. The exploit does not require elevated privileges beyond those of the service process. The EPSS score is <1%, indicating a low likelihood of widespread exploitation, but the CVSS score of 7.5 reflects a high impact from the privilege level of the service. The vulnerability is not listed in the CISA KEV catalog. The ability to read any file the process can access poses a significant confidentiality risk.