Executive brief
Composio is an open-source library that enables AI agents to interact with tools and services. A directory traversal vulnerability in the file download function allows remote attackers to read arbitrary files from the server without authentication, potentially exposing sensitive configuration data, source code, or credentials.
Technical details
A directory traversal vulnerability exists in ComposioHQ's _download_file_or_dir function (located in python/composio/server/api.py) that fails to properly validate or sanitize file path inputs. An attacker can exploit this by providing specially crafted path traversal sequences (e.g., "../") to access files outside the intended directory. The vulnerability requires only network access and no authentication; an unauthenticated remote attacker can read arbitrary files on the system where Composio is running. The CVE references suggest PoC exploits are publicly available, though exploitation in the wild has not been reported as of the advisory date.
Affected products
- ComposioHQ Composio 0.7.20 and earlier
Timeline
- 2025-12-04: disclosed
- 2025-12-05: other: GitHub advisory reviewed