---
id: "CVE-2024-8537"
kind: "vulnerability"
aliases: ["CVE-2024-8537", "GHSA-c4cc-w454-4634"]
title: "AgentScope path traversal vulnerability"
severity: "critical"
cvss: 9.1
epss: 0.0104
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "agentscope", "fixed": [], "affected": "<= 0.1.1", "ecosystem": "pypi"}, {"name": "modelscope agentscope", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["pypi", "vendor"]
tags: ["agentscope", "ai-tooling", "cwe-22", "cwe-29", "python", "self-hosted"]
not_affected_if: ["library-only-use"]
published_at: "2025-03-20T10:15:42+00:00"
first_seen_at: "2026-10-26T20:56:17+00:00"
updated_at: "2026-10-26T21:20:32+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-c4cc-w454-4634", "first_seen_at": "2026-10-26T20:56:17+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8537", "first_seen_at": "2026-10-26T21:20:32+00:00"}]
---

# AgentScope path traversal vulnerability

AgentScope, a Python agent framework, has a path traversal flaw in its /delete-workflow endpoint because file paths are not validated. An attacker can delete arbitrary files on the server outside the intended directory.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:agentscope affected <= 0.1.1 fixed ?
- vendor:modelscope agentscope affected ? fixed ?

## How to check

- Run `pip show agentscope` and check whether the version is `0.1.1` or lower
- Check whether the AgentScope web service exposes a `/delete-workflow` endpoint

## Timeline

- 2026-10-26T20:56:17+00:00 ghsa https://github.com/advisories/GHSA-c4cc-w454-4634
- 2026-10-26T21:20:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-8537

## From the sources

A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. The vulnerability is present in the /delete-workflow endpoint, allowing an attacker to delete arbitrary files from the filesystem. This issue arises due to improper input validation, enabling the attacker to manipulate file paths and delete sensitive files outside of the intended directory.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_