Vulnerability in Modelscope Agentscope
CVE-2024-8537
A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. The vulnerability is present in the /delete-workflow endpoint, allowing an attacker to delete arbitrary files from the filesystem. This issue arises due to improper input validation, enabling the attacker to manipulate file paths and delete sensitive files outside of the intended directory.
EPSS: 0.010 (57.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.
Affected products
- Modelscope Agentscope
- Modelscope Modelscope/agentscope — versions unspecified
Weakness classification (CWE)
References
- security@huntr.dev (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2024-8537?
- CVE-2024-8537 is a critical-severity vulnerability in Modelscope Agentscope, classified under CWE-29. CVSS score: 9.1/10. Published 2025-03-20.
- How severe is CVE-2024-8537?
- Critical severity. CVSS v3 base score is 9.1 out of 10.