A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.4. This vulnerability allows an attacker to read the contents of any file in the system by exploiting the BROWSERTOOL_GOTO_PAGE and BROWSERTOOL_GET_PAGE_DETAILS actions.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Composio
  • Composio
Composiohq
  • Composio

Configuration 1 [-]

cpe:2.3:a:composio:composio:0.4.4:*:*:*:*:*:*:*

No data.

References
Link Providers
https://huntr.com/bounties/13bc0399-2d9b-449e-95f2-6e9a7e39383d cve-icon cve-icon
History

Wed, 15 Oct 2025 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-643

Wed, 15 Oct 2025 13:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-918

Wed, 16 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00047}

 epss

{'score': 0.00043}

Tue, 15 Jul 2025 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Composio
Composio composio
CPEs cpe:2.3:a:composio:composio:0.4.4:*:*:*:*:*:*:*
Vendors & Products Composio
Composio composio
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Thu, 20 Mar 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 20 Mar 2025 10:15:00 +0000

Type Values Removed Values Added
Description A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.4. This vulnerability allows an attacker to read the contents of any file in the system by exploiting the BROWSERTOOL_GOTO_PAGE and BROWSERTOOL_GET_PAGE_DETAILS actions.
Title SSRF in composiohq/composio
Weaknesses CWE-643
References
Metrics cvssV3_0

{'score': 6.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: @huntr_ai

Published: 2025-03-20T10:09:27.940Z

Updated: 2025-10-15T12:50:43.991Z

Reserved: 2024-09-17T18:24:07.208Z

Link: CVE-2024-8955

cve-icon Vulnrichment

Updated: 2025-03-20T17:50:54.299Z

cve-icon NVD

Status : Modified

Published: 2025-03-20T10:15:45.087

Modified: 2025-10-15T13:15:56.233

Link: CVE-2024-8955

cve-icon Redhat

No data.