Directory Traversal Vulnerability in ComposioHQ Affected by Remote Exploits
CVE-2025-56427

7.5HIGH

Key Information:

Vendor

ComposioHQ

Status
ComposioHQ
Vendor
CVE Published:
4 December 2025

What is CVE-2025-56427?

A directory traversal vulnerability exists in ComposioHQ v0.7.20, allowing unauthorized access to sensitive information. This flaw can be exploited by remote attackers through the _download_file_or_dir function, potentially leading to exposure of critical files on the server. Proper validation and sanitization of file paths are essential to mitigate this risk.

References

https://github.com/ComposioHQ/composio/blob/master/python...
https://github.com/TOAST-Research/pocs/blob/main/composio...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.