Executive brief
AgentScope is a framework used to build multi-agent applications powered by large language models. A security flaw in its file management interface allows an attacker to bypass directory restrictions and read any file on the host server. This could lead to the theft of sensitive configuration data, credentials, or private application files, potentially compromising the entire server.
Technical details
A path traversal vulnerability (CWE-22) exists in ModelScope AgentScope version 0.0.4 and earlier. The vulnerability is located in the `/api/file` endpoint within the `src/agentscope/studio/_app.py` component. The application fails to properly sanitize the `path` parameter, allowing an attacker to use dot-dot-slash (`../`) sequences to escape the intended directory. An unauthenticated remote attacker can exploit this to read arbitrary files from the underlying filesystem with the privileges of the application process. As of the advisory date, no patched version has been identified.
Affected products
- ModelScope AgentScope <= 0.0.4
Timeline
- 2025-03-20: disclosed
- 2025-03-20: advisory