# CVE-2026-59807: Composio SDK path validation bypass in CLI tool-file-uploads

Source: https://junglewise.ai/threats/cve-2026-59807-composio-sdk-path-validation-bypass-in-cli-tool-file-uploads  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-59807 · Severity: medium · CVSS 6.8 · Published 2026-07-08

Composio is an SDK used to connect AI agents and LLMs to external tools and services. A security flaw in the CLI component allowed attackers to trick AI agents into uploading sensitive local files, such as SSH keys, AWS credentials, and environment files, to attacker-controlled servers. This could lead to a full compromise of the user's cloud infrastructure or private accounts.

Technologies: [ComposioHQ Composio](https://junglewise.ai/threats/technologies/composio). Vendors: [ComposioHQ](https://junglewise.ai/threats/vendors/composiohq).

## Quick answers

**Is CVE-2026-59807 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59807 being exploited in the wild.

**How severe is CVE-2026-59807?** Medium severity, with a CVSS score of 6.8, published 8 July 2026.

**Which products and versions are affected?** ComposioHQ Composio < 0.2.32-beta.283.

**Is there a fix for CVE-2026-59807?** A patch was published on 2026-07-06: Fix merged in PR #3763 and released in 0.2.32-beta.283 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59807 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59807?** Check whether you run ComposioHQ Composio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path validation bypass vulnerability exists in the Composio CLI due to a missing 'assertSafeFileUploadPath' check in the 'readFileFromDisk' function within 'tool-file-uploads.ts'. While the core SDK and Python versions implemented a sensitive-file denylist, the CLI's duplicate upload path did not. An attacker can use prompt injection against an LLM-driven agent to manipulate 'file_uploadable' parameters, referencing sensitive local paths (e.g., ~/.ssh/id_rsa). This causes the CLI to read and upload these credential files to an attacker-controlled storage location. The issue is fixed in version 0.2.32-beta.283 by unifying the security guard across all SDK primitives.

## Affected products

- ComposioHQ composio < 0.2.32-beta.283

## Timeline

- 2026-07-06: patched: Fix merged in PR #3763 and released in 0.2.32-beta.283
- 2026-07-08: disclosed: CVE-2026-59807 published

## References

- [https://github.com/ComposioHQ/composio/commit/fc17c37bf95b7ece5c038cb7e2ab7e3e4a064e3a](https://github.com/ComposioHQ/composio/commit/fc17c37bf95b7ece5c038cb7e2ab7e3e4a064e3a)
- [https://github.com/ComposioHQ/composio/issues/3746](https://github.com/ComposioHQ/composio/issues/3746)
- [https://github.com/ComposioHQ/composio/pull/3763](https://github.com/ComposioHQ/composio/pull/3763)
- [https://github.com/ComposioHQ/composio/releases/tag/%40composio%2Fcli%400.2.32-beta.283](https://github.com/ComposioHQ/composio/releases/tag/%40composio%2Fcli%400.2.32-beta.283)
- [https://www.vulncheck.com/advisories/composio-sdk-beta-283-sensitive-file-upload-via-tool-file-uploads-ts](https://www.vulncheck.com/advisories/composio-sdk-beta-283-sensitive-file-upload-via-tool-file-uploads-ts)

## Related threats

- [PYSEC-2026-1262 - ComposioHQ has a directory traversal vulnerability](https://junglewise.ai/threats/cve-2025-56427-composio-directory-traversal-in-file-download)