CVE-2024-8958 Unrestricted File Write and Read in composiohq/composio
Attackers can read and write arbitrary files via path traversal in filetools, potentially leading to remote code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-8958?
CVE-2024-8958 is a high-severity path traversal vulnerability in composiohq/composio, published on 20 Mar 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
In composiohq/composio version 0.4.3, there is an unrestricted file write and read vulnerability in the filetools actions. Due to improper validation of file paths, an attacker can read and write files anywhere on the server, potentially leading to privilege escalation or remote code execution.
Weakness: CWE-434
Which versions are affected by CVE-2024-8958?
It affects 1 product.
Products include Composio Composio.
How do I fix CVE-2024-8958?
No fix has been published for CVE-2024-8958 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-8958 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-8958 exists.
Other vulnerabilities in composiohq/composio
Sources
Also known as GHSA-8fw3-c8jq-g74q.