VYPR
← All advisories
High severity7.5NVD Advisory· Published Feb 10, 2025· Updated Jun 17, 2026

CVE-2024-8550

CVE-2024-8550

Description

A Local File Inclusion (LFI) vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. This vulnerability allows an attacker to read arbitrary files from the server, including sensitive files such as API keys, by manipulating the filename parameter. The issue arises due to improper sanitization of user input passed to the os.path.join function, which can be exploited to access files outside the intended directory.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Modelscope/Agentscope3 versions
    cpe:2.3:a:modelscope:agentscope:0.0.4:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:modelscope:agentscope:0.0.4:*:*:*:*:*:*:*
    • (no CPE)range: = v0.0.4
    • (no CPE)range: unspecified

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.