CVE-2024-8524

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A directory traversal vulnerability exists in modelscope/agentscope version 0.0.4. An attacker can exploit this vulnerability to read any local JSON file by sending a crafted POST request to the /read-examples endpoint.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Mar 20, 2025
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-852510.0An unrestricted upload of file with dangerous type in Automated Logic WebCTRL 7.0 could allow an unauthenticated user to perform remote commCVE-2024-85265.9A vulnerability in Automated Logic WebCTRL 7.0 could allow an attacker to send a maliciously crafted URL, which when visited by an authenticCVE-2024-85278.6Open Redirect in URL parameter in Automated Logic WebCTRL and Carrier i-Vu versions 6.0, 6.5, 7.0, 8.0, 8.5, 9.0 may allow attackers to explCVE-2024-85285.4Reflected XSS using a specific URL in Automated Logic WebCTRL and Carrier i-VU can allow delivery of malicious payload due to a specific GETCVE-2024-85297.5The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_fields' parameter of the /wp-json/lp/v1CVE-2024-85305.9CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause exposure of private data when an already generatCVE-2024-85317.2CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that could compromise the Data Center Expert software when anCVE-2024-85338.8A privilege escalation vulnerability exists in the Rockwell Automation affected products. The vulnerability occurs due to improper default fCVE-2024-85348.1Memory safety vulnerability leading to memory corruption and Denial of Service in NetScaler ADC and Gateway if the appliance must be configuCVE-2024-85358.1Authenticated user can access unintended user capabilities in NetScaler ADC and NetScaler Gateway if the appliance must be configured as a GCVE-2024-85365.4The Ultimate Blocks WordPress plugin before 3.2.2 does not validate and escape some of its block attributes before outputting them back in CVE-2024-85379.1A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. The vulnerability is present in the