CVE-2024-8551 - CVE House
Back to Database
Status published Critical CVE-2024-8551

Path Traversal in modelscope/agentscope

Vulnerability Description

A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope versions prior to the fix. This vulnerability allows an attacker to read and write arbitrary JSON files on the filesystem, potentially leading to the exposure or modification of sensitive information such as configuration files, API keys, and hardcoded passwords.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-8551

Credits & Attribution

No credits recorded in the NVD database.

References

More from modelscope

View All →
CVE-2024-8556
Stored XSS in modelscope/agentscope
Medium 6.1
CVE-2024-8550
Local File Inclusion (LFI) in modelscope/agentscope
High 7.5
CVE-2024-8537
Path Traversal in modelscope/agentscope
Critical 9.1
CVE-2024-8524
Directory Traversal in modelscope/agentscope
High 7.5
CVE-2024-8502
Remote Code Execution via Deserialization in modelscope/agentscope
Critical 9.8

Affected Vendor

Affected Software

modelscope/agentscope
Vulnerable Versions:
unspecified

Timeline

Official Publish: March 20th, 2025
Last Modified: October 15th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weaknesses (CWE)

CWE-23

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1105 Ingress Tool Transfer
Command and Control
T1565 Data Manipulation
Impact