affected:
- ecosystem_specific: {}
  package:
    ecosystem: PyPI
    name: agentscope
    purl: pkg:pypi/agentscope
  ranges:
  - events:
    - introduced: '0'
    - last_affected: 0.0.4
    type: ECOSYSTEM
  versions:
  - 0.0.1
  - 0.0.2
  - 0.0.3
  - 0.0.4
aliases:
- CVE-2024-8550
details: A Local File Inclusion (LFI) vulnerability exists in the /load-workflow endpoint
  of modelscope/agentscope version v0.0.4. This vulnerability allows an attacker to
  read arbitrary files from the server, including sensitive files such as API keys,
  by manipulating the filename parameter. The issue arises due to improper sanitization
  of user input passed to the os.path.join function, which can be exploited to access
  files outside the intended directory.
id: PYSEC-2025-84
modified: '2026-05-21T14:54:21.316144Z'
published: '2025-02-10T19:15:39.440Z'
references:
- type: EVIDENCE
  url: https://huntr.com/bounties/7cd8f519-7c75-4936-889d-a17ea1bcb3ea
severity:
- score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  type: CVSS_V3