CVE-2024-8537

Summary

CVE-2024-8537 is a newly-discovered path traversal vulnerability that affects the modelscope/agentscope application, impacting all its versions. The weakness lies in the /delete-workflow endpoint, where an attacker can craft malicious input to traverse and delete arbitrary files from the system. This issue arises due to inadequate input validation, allowing the attacker to manipulate file paths and delete sensitive files outside of the designated directory. Successful exploitation of this vulnerability could result in data leakage, unauthorized file modifications, and potential system compromise. Users are strongly advised to update to the latest patched version of the application to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.