Modelscope Agentscope Path Traversal Vulnerability Allowing Arbitrary File Deletion

A path traversal vulnerability has been identified in the modelscope/agentscope application, affecting all versions. This vulnerability exists in the /delete-workflow endpoint, where improper input validation allows attackers to manipulate file paths and delete arbitrary files from the filesystem, including sensitive files located outside of the intended directory.

Impact

Exploitation of this vulnerability allows for arbitrary file deletion, which could lead to the removal of critical application or system files.