AI agent vulnerability · Composio

CVE-2025-56427: ComposioHQ has a directory traversal vulnerability

mediumCVSS 4.0 5.5 · 3.1 7.5GHSA-3mwv-j45g-vp3w

Directory Traversal vulnerability in ComposioHQ v.0.7.20 allows a remote attacker to obtain sensitive information via the downloadfileordir function.

Published Dec 4, 2025 · Updated Dec 5, 2025

Affected packages

composio

Ecosystem: PyPI
Affected: <= 0.7.20
Fixed in: No patched version yet
Check: pip show composio

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Directory Traversal vulnerability in ComposioHQ v.0.7.20 allows a remote attacker to obtain sensitive information via the _download_file_or_dir function.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-56427
https://github.com/ComposioHQ/composio/blob/master/python/composio/server/api.py#L278
https://github.com/TOAST-Research/pocs/blob/main/composio/composio_1.md
https://github.com/advisories/GHSA-3mwv-j45g-vp3w

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology