CVE-2026-59807 — Composio SDK < 0.2.32-beta.283 - Sensitive File Upload via tool-file-uploads.ts
Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows attackers to read and exfiltrate sensitive files by exploiting a missing assertSa…
Published: 2026-07-08 · CVSS: 8.9 · CVSS 4.0
Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows attackers to read and exfiltrate sensitive files by exploiting a missing assertSafeFileUploadPath check in the readFileFromDisk function within tool-file-uploads.ts. Attackers can exploit prompt injection to manipulate file_uploadable parameters to reference sensitive paths such as SSH private keys, causing the CLI to upload credential files to attacker-controlled storage.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7