{"id":"CVE-2024-8537","kind":"vulnerability","aliases":["CVE-2024-8537","GHSA-c4cc-w454-4634"],"related":[],"title":"AgentScope path traversal vulnerability","description":"A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. The vulnerability is present in the /delete-workflow endpoint, allowing an attacker to delete arbitrary files from the filesystem. This issue arises due to improper input validation, enabling the attacker to manipulate file paths and delete sensitive files outside of the intended directory.","summary":"AgentScope, a Python agent framework, has a path traversal flaw in its /delete-workflow endpoint because file paths are not validated. An attacker can delete arbitrary files on the server outside the intended directory.","severity":"critical","cvss":9.1,"epss":0.0104,"exploited":false,"exploited_at":null,"products":[{"name":"agentscope","fixed":[],"affected":"<= 0.1.1","ecosystem":"pypi"},{"name":"modelscope agentscope","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["agentscope","ai-tooling","cwe-22","cwe-29","python","self-hosted"],"not_affected_if":["library-only-use"],"how_to_check":"- Run `pip show agentscope` and check whether the version is `0.1.1` or lower\n- Check whether the AgentScope web service exposes a `/delete-workflow` endpoint","fix":null,"status":"open","published_at":"2025-03-20T10:15:42+00:00","first_seen_at":"2026-10-26T20:56:17+00:00","triaged_at":"2026-10-26T21:08:29+00:00","updated_at":"2026-10-26T21:20:32+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-26T21:08:29Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"AgentScope: path traversal in /delete-workflow lets attackers delete arbitrary files","impact":"medium","summary":"AgentScope, a Python agent framework, has a path traversal flaw in its /delete-workflow endpoint because file paths are not validated. An attacker can delete arbitrary files on the server outside the intended directory.","category":"ai-tooling","nicknames":[],"who_cares":["python","agentscope","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker deletes sensitive files anywhere the service process can write.","analyst_note":"Find the fixed AgentScope version and whether the /delete-workflow endpoint requires authentication, via https://github.com/advisories/GHSA-c4cc-w454-4634.","how_to_check":"- Run `pip show agentscope` and check whether the version is `0.1.1` or lower\n- Check whether the AgentScope web service exposes a `/delete-workflow` endpoint","needs_analyst":true,"not_affected_if":["library-only-use"],"who_is_affected":"Deployments of AgentScope at version `0.1.1` or lower that run its web service and expose the /delete-workflow endpoint are exposed. The sources say the issue affects all versions and do not name a fixed release. Teams that only import the library without running this endpoint are less likely to be exposed, but the sources do not confirm this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000605,"input_tokens":3371,"output_tokens":536,"severity_before":"critical"},"analyst_status":"queued","analyst_note":"Find the fixed AgentScope version and whether the /delete-workflow endpoint requires authentication, via https://github.com/advisories/GHSA-c4cc-w454-4634.","search":"'-2024':6A,14A '-22':24B '-29':26B '-8537':7A,15A '/delete-workflow':43B,82C '4634':12A 'affect':73C 'agent':34B 'agentscop':1A,19B,31B 'agentscope':16A,18A 'ai':21B 'ai-tool':20B 'allow':84C 'applic':72C 'arbitrari':55B,89C 'aris':96C 'attack':52B,86C,104C 'c4cc':10A 'cve':5A,13A 'cwe':23B,25B 'delet':54B,88C,110C 'directori':63B,117C 'due':97C 'enabl':102C 'endpoint':44B,83C 'exist':68C 'file':46B,56B,90C,107C,112C 'filesystem':93C 'flaw':40B 'framework':35B 'ghsa':9A 'ghsa-c4cc-w454':8A 'host':30B 'improp':99C 'input':100C 'intend':62B,116C 'issu':95C 'manipul':106C 'modelscope':17A 'modelscope/agentscope':71C 'outsid':60B,113C 'path':2A,38B,47B,65C,108C 'present':79C 'python':27B,33B 'self':29B 'self-host':28B 'sensit':111C 'server':59B 'tool':22B 'travers':3A,39B,66C 'valid':50B,101C 'version':75C 'vulner':4A,67C,77C 'w454':11A","nicknames":[],"mitigations":[],"who_affected":"Deployments of AgentScope at version `0.1.1` or lower that run its web service and expose the /delete-workflow endpoint are exposed. The sources say the issue affects all versions and do not name a fixed release. Teams that only import the library without running this endpoint are less likely to be exposed, but the sources do not confirm this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2025-03-20T10:15:42+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-c4cc-w454-4634","url":"https://github.com/advisories/GHSA-c4cc-w454-4634","severity":"critical","published_at":"2025-03-20T12:32:48+00:00","modified_at":"2026-10-26T20:55:12+00:00","first_seen_at":"2026-10-26T20:56:17+00:00","fetched_at":"2026-10-26T20:56:17+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-8537","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8537","severity":null,"published_at":"2025-03-20T10:15:42+00:00","modified_at":"2026-06-17T08:22:48+00:00","first_seen_at":"2026-10-26T21:20:32+00:00","fetched_at":"2026-10-26T21:20:32+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}