CVE-2024-8550

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A Local File Inclusion (LFI) vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. This vulnerability allows an attacker to read arbitrary files from the server, including sensitive files such as API keys, by manipulating the filename parameter. The issue arises due to improper sanitization of user input passed to the os.path.join function, which can be exploited to access files outside the intended directory.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-497

Affected software

No affected versions have been published.

Timeline

Published
Feb 10, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-85519.1A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope versions prior to the fiCVE-2024-85524.3The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enableCVE-2024-85536.3A vulnerability was found in Foreman's loader macros introduced with report templates. These macros may allow an authenticated user with perCVE-2024-85545.4A vulnerability was found in SourceCodester Clinics Patient Management System 2.0 and classified as problematic. This issue affects some unkCVE-2024-85556.1A vulnerability was found in SourceCodester Clinics Patient Management System 2.0. It has been classified as problematic. Affected is an unkCVE-2024-85566.1A stored cross-site scripting (XSS) vulnerability exists in modelscope/agentscope, as of the latest commit 21161fe on the main branch. The vCVE-2024-85577.5A vulnerability classified as critical has been found in SourceCodester Food Ordering Management System 1.0. This affects an unknown part ofCVE-2024-85584.3A vulnerability classified as problematic was found in SourceCodester Food Ordering Management System 1.0. This vulnerability affects unknowCVE-2024-85597.2A vulnerability, which was classified as critical, has been found in SourceCodester Online Food Menu 1.0. This issue affects some unknown prCVE-2024-85608.8A vulnerability, which was classified as critical, was found in SourceCodester Simple Invoice Generator System 1.0. Affected is an unknown fCVE-2024-85619.8A vulnerability has been found in SourceCodester PHP CRUD 1.0 and classified as critical. Affected by this vulnerability is an unknown functCVE-2024-85626.1A vulnerability was found in SourceCodester PHP CRUD 1.0 and classified as problematic. Affected by this issue is some unknown functionality
CVE-2024-8550: High severity, CVSS 7.5 | Vulnix