ComposioHQ Composio SDK up to 0.2.32-beta.282 File Upload tool-file-uploads.ts readFileFromDisk file_uploadable unrestricted upload

Summaryinfo

A vulnerability classified as critical has been found in ComposioHQ Composio SDK up to 0.2.32-beta.282. Affected is the function readFileFromDisk of the file tool-file-uploads.ts of the component File Upload. The manipulation of the argument file_uploadable leads to unrestricted upload. This vulnerability is documented as CVE-2026-59807. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in ComposioHQ Composio SDK up to 0.2.32-beta.282. It has been rated as critical. This issue affects the function readFileFromDisk of the file tool-file-uploads.ts of the component File Upload. The manipulation of the argument file_uploadable with an unknown input leads to a unrestricted upload vulnerability. Using CWE to declare the problem leads to CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows attackers to read and exfiltrate sensitive files by exploiting a missing assertSafeFileUploadPath check in the readFileFromDisk function within tool-file-uploads.ts. Attackers can exploit prompt injection to manipulate file_uploadable parameters to reference sensitive paths such as SSH private keys, causing the CLI to upload credential files to attacker-controlled storage.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-59807 since 07/07/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1608.002 according to MITRE ATT&CK.

Upgrading to version 0.2.32-beta.283 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• ComposioHQ

Name

• Composio SDK

Version

• 0.2.32-beta.282

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion