Executive brief
MetaGPT's Self-Prompt Optimization (SPO) extension contains a file-handling vulnerability that allows an attacker to read arbitrary files from the server. By supplying a crafted filename with path traversal sequences (like `../`), an attacker can escape the intended settings directory and access sensitive files anywhere on the system. This poses a direct risk to confidential data stored on systems running the SPO extension, particularly if the application is exposed to untrusted users.
Technical details
A path traversal vulnerability (CWE-22) exists in `metagpt/ext/spo/utils/load.py` where the `set_file_name()` function accepts an attacker-controlled FILE_NAME parameter that is directly concatenated into a filesystem path without validation. The `load_meta_data()` function then opens this unsanitized path using `Path.open()`, allowing traversal sequences like `../../../../tmp/secret.yaml` to escape the intended settings directory. Authentication is required (PR:L), but once authenticated, an attacker can read arbitrary files with the permissions of the process. A related write vulnerability exists in `save_yaml_template()` which could enable arbitrary file write. Patches or mitigations have not been confirmed as available in the advisory.
Affected products
- MetaGPT MetaGPT 0.8.1
Timeline
- 2026-08-31: disclosed