CVE-2024-8537 - CVE House
Back to Database
Status published Critical CVE-2024-8537

Path Traversal in modelscope/agentscope

Vulnerability Description

A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. The vulnerability is present in the /delete-workflow endpoint, allowing an attacker to delete arbitrary files from the filesystem. This issue arises due to improper input validation, enabling the attacker to manipulate file paths and delete sensitive files outside of the intended directory.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-8537

Credits & Attribution

No credits recorded in the NVD database.

References

More from modelscope

View All →
CVE-2024-8556
Stored XSS in modelscope/agentscope
Medium 6.1
CVE-2024-8551
Path Traversal in modelscope/agentscope
Critical 9.1
CVE-2024-8550
Local File Inclusion (LFI) in modelscope/agentscope
High 7.5
CVE-2024-8524
Directory Traversal in modelscope/agentscope
High 7.5
CVE-2024-8502
Remote Code Execution via Deserialization in modelscope/agentscope
Critical 9.8

Affected Vendor

Affected Software

modelscope/agentscope
Vulnerable Versions:
unspecified

Timeline

Official Publish: March 20th, 2025
Last Modified: March 20th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weaknesses (CWE)

CWE-29

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.