Junglewise Threat Intelligence

CVE-2026-59807: Composio SDK path validation bypass in CLI tool-file-uploads

CVE-2026-59807 · Severity: medium · CVSS 6.8 · Published 2026-07-08

Technologies: ComposioHQ Composio. Vendors: ComposioHQ.

Executive brief

Composio is an SDK used to connect AI agents and LLMs to external tools and services. A security flaw in the CLI component allowed attackers to trick AI agents into uploading sensitive local files, such as SSH keys, AWS credentials, and environment files, to attacker-controlled servers. This could lead to a full compromise of the user's cloud infrastructure or private accounts.

Technical details

A path validation bypass vulnerability exists in the Composio CLI due to a missing 'assertSafeFileUploadPath' check in the 'readFileFromDisk' function within 'tool-file-uploads.ts'. While the core SDK and Python versions implemented a sensitive-file denylist, the CLI's duplicate upload path did not. An attacker can use prompt injection against an LLM-driven agent to manipulate 'file_uploadable' parameters, referencing sensitive local paths (e.g., ~/.ssh/id_rsa). This causes the CLI to read and upload these credential files to an attacker-controlled storage location. The issue is fixed in version 0.2.32-beta.283 by unifying the security guard across all SDK primitives.

Affected products

  • ComposioHQ composio < 0.2.32-beta.283

Timeline

  • 2026-07-06: patched: Fix merged in PR #3763 and released in 0.2.32-beta.283
  • 2026-07-08: disclosed: CVE-2026-59807 published

References

Related threats