CVE-2024-8550 - CVE House
Back to Database
Status published High CVE-2024-8550

Local File Inclusion (LFI) in modelscope/agentscope

Vulnerability Description

A Local File Inclusion (LFI) vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. This vulnerability allows an attacker to read arbitrary files from the server, including sensitive files such as API keys, by manipulating the filename parameter. The issue arises due to improper sanitization of user input passed to the os.path.join function, which can be exploited to access files outside the intended directory.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-8550

Credits & Attribution

No credits recorded in the NVD database.

References

More from modelscope

View All →
CVE-2024-8556
Stored XSS in modelscope/agentscope
Medium 6.1
CVE-2024-8551
Path Traversal in modelscope/agentscope
Critical 9.1
CVE-2024-8537
Path Traversal in modelscope/agentscope
Critical 9.1
CVE-2024-8524
Directory Traversal in modelscope/agentscope
High 7.5
CVE-2024-8502
Remote Code Execution via Deserialization in modelscope/agentscope
Critical 9.8

Affected Vendor

Affected Software

modelscope/agentscope
Vulnerable Versions:
unspecified

Timeline

Official Publish: February 10th, 2025
Last Modified: February 10th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-497

MITRE ATT&CK TTPs

T1592 Gather Victim Host Information
Reconnaissance
T1082 System Information Discovery
Discovery
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1041 Exfiltration Over C2 Channel
Exfiltration