CVE-2024-8865

CVE-2024-8865 is a path traversal vulnerability affecting composiohq composio versions up to 0.5.8, specifically within the composio\server\api.py file's handling of the 'file' argument. This flaw allows a highly privileged attacker to read arbitrary files on the system. Rated with a CVSS score of 4.9 (Medium), the vulnerability has a network attack vector and low attack complexity, but requires high privileges (PR:H) to exploit, leading to a high impact on confidentiality (C:H) with no impact on integrity or availability. While the exploit has been publicly disclosed, there is no evidence of active exploitation, nor are there readily available exploit modules in Metasploit or Nuclei. Community discussion and media coverage for this CVE are minimal.