ModelScope AgentScope Path Traversal Vulnerability Allowing Arbitrary File Read and Write

A path traversal vulnerability has been identified in the save-workflow and load-workflow functionalities of ModelScope AgentScope, affecting versions prior to the fix. This vulnerability enables an attacker to read and write arbitrary JSON files on the filesystem, which could lead to the exposure or modification of sensitive information such as configuration files, API keys, and hardcoded passwords.

Impact

Exploitation of this vulnerability could result in unauthorized access to or modification of sensitive information, including configuration files, API keys, and hardcoded passwords.