PrivacyHigh
CVE-2026-59807: Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows atta…
- Occurred
- Jul 8, 2026
- Published
- Jul 8, 2026
- Source
- NVD CVE
Summary
Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows attackers to read and exfiltrate sensitive files by exploiting a missing assertSafeFileUploadPath check in the readFileFromDisk function within tool-file-uploads.ts. Attackers can exploit prompt injection to manipulate file_uploadable parameters to reference sensitive paths such as SSH private keys, causing the CLI to upload credential files to attacker-controlled storage.
Tags
- CVE
- CVE-2026-59807
- cvss:MEDIUM
Classification
Category confidence: 90%
Severity confidence: 85%
Rationale: Vulnerability allows unauthorized access and exfiltration of sensitive files via prompt injection.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8