Path Traversal in modelscope/agentscope

Root

Cause A path traversal vulnerability exists in the /delete-workflow endpoint of the modelscope/agentscope application, affecting all versions. The issue arises from improper input validation of user-supplied filenames, allowing an attacker to manipulate file paths and delete sensitive files outside of the intended directory. The vulnerability stems from insufficient checks on the filename parameter, enabling path traversal sequences like ../ to reference arbitrary locations on the filesystem [2][3].

Exploitation

Exploitation requires network access to the AgentScope application and the ability to send HTTP requests to the /delete-workflow endpoint. An attacker can craft a request with a malicious filename containing path traversal sequences (e.g., ../../etc/passwd). No authentication is mentioned as a prerequisite, making the vulnerability accessible to any unauthenticated user who can reach the endpoint [2][3].

Impact

Successful exploitation allows an attacker to delete arbitrary files on the server. This can lead to data loss, service disruption, or potential compromise of the application if critical configuration files, databases, or executables are removed. The severity is high due to the potential for irreversible damage [2].

Mitigation

The vendor has addressed the vulnerability in a commit [4] that adds two critical checks: first, it verifies that the filename ends with .json, restricting deletions to only JSON files; second, it uses os.path.basename() to strip any directory components from the filename, effectively preventing path traversal. Users are advised to update to the latest version of AgentScope that includes this fix [1][4].