CVE-2024-8550

NONE EPSS 37.9%
Published Feb 10, 20251y ago · Modified Jun 17, 20262w ago
Find Similar
Published Feb 10, 2025 1y ago
Last Modified Jun 17, 2026 2w ago

Description

A Local File Inclusion (LFI) vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. This vulnerability allows an attacker to read arbitrary files from the server, including sensitive files such as API keys, by manipulating the filename parameter. The issue arises due to improper sanitization of user input passed to the os.path.join function, which can be exploited to access files outside the intended directory.

Threat Intelligence

EPSS Exploit Probability
37.9% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 1

CWE-497

Affected Products 1

VendorProductVersionRange
modelscopeagentscope0.0.4any

References 1

  • huntr.com https://huntr.com/bounties/7cd8f519-7c75-4936-889d-a17ea1bcb3ea
    ExploitThird Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.