GitHub Advisoryadvisory · PyPI

GHSA-3mwv-j45g-vp3w ComposioHQ has a directory traversal vulnerability

MEDIUM Published 2025-12-04 Modified 2025-12-05 Official page ↗
Aliases
CVE-2025-56427
Ecosystem
PyPI
Packages
composio
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-22
Reviewed
2025-12-05

Affected packages

• PyPI composio: <= 0.7.20 (no fix yet)

Description

Directory Traversal vulnerability in ComposioHQ v.0.7.20 allows a remote attacker to obtain sensitive information via the _download_file_or_dir function.

Related

Alias · CVE (1)

  • CVE-2025-56427 Directory Traversal vulnerability in ComposioHQ v.0.7.20 allows a remote attacker to obtain sensitive information via the… vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References