What is CVE-2024-8551?

CVE-2024-8551 is a critical-severity vulnerability in Modelscope Agentscope, classified under Relative Path Traversal. CVSS score: 9.1/10. Published 2025-03-20.

How severe is CVE-2024-8551?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Path Traversal in Modelscope Agentscope

CVE-2024-8551

A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope versions prior to the fix. This vulnerability allows an attacker to read and write arbitrary JSON files on the filesystem, potentially leading to the exposure or modification of sensitive information such as configuration files, API keys, and hardcoded passwords.

EPSS: 0.009 (56.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

Affected products

Modelscope Agentscope
Modelscope Modelscope/agentscope — versions unspecified

Weakness classification (CWE)

CWE-23 — Relative Path Traversal

References

security@huntr.dev (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2024-8551?: CVE-2024-8551 is a critical-severity vulnerability in Modelscope Agentscope, classified under Relative Path Traversal. CVSS score: 9.1/10. Published 2025-03-20.
How severe is CVE-2024-8551?: Critical severity. CVSS v3 base score is 9.1 out of 10.