Description

A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the FILE_NAME value used by set_file_name() and load_meta_data() in metagpt/ext/spo/utils/load.py. The vulnerable code joins the attacker-controlled FILE_NAME value with the settings directory and opens the resulting path without validating that the resolved path remains within the intended directory.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-31T21:17:48.900Z",
  "pubdate": "2026-08-31T21:17:48.900Z",
  "executiveSummary": "A path traversal vulnerability exists in the SPO extension of MetaGPT version 0.8.1, stemming from insecure file path handling. The vulnerability allows a remote attacker to read arbitrary files from the host filesystem by supplying a malicious FILE_NAME parameter. This issue resides within the load_meta_data() function, which fails to sanitize user-provided input before using it in file system operations. The risk implication is significant, as it enables unauthorized disclosure of sensitive data, including configuration files, credentials, or system information, potentially leading to full system compromise depending on the environment permissions. No authentication is explicitly required to trigger this path traversal, making it a high-risk vector for malicious actors.",
  "technicalDetails": "The root cause of the vulnerability is an insecure implementation of file path construction within the metagpt/ext/spo/utils/load.py file. Specifically, the functions set_file_name() and load_meta_data() process the FILE_NAME variable, which is attacker-controlled, and perform a path join operation against a base directory without performing path canonicalization or validation. By utilizing dot-dot-slash (../) sequences in the FILE_NAME string, an attacker can escape the intended directory structure and reference arbitrary files elsewhere on the filesystem.\nThe exploitation flow initiates when a user or external input vector triggers the set_file_name() function with a malicious payload designed to traverse directories. When load_meta_data() is subsequently called, the application uses the os.path.join (or equivalent joining logic) to append the attacker's input to the settings directory path. Because the code does not verify that the resulting path is a child of the base directory using methods such as os.path.abspath() and subsequent string prefix checking, the underlying operating system executes a read operation on the resolved absolute path.\nThe vulnerable component is identified as the SPO extension utility layer within MetaGPT 0.8.1. The attack is successful because the application blindly trusts the FILE_NAME input. An attacker can craft payloads such as '../../../etc/passwd' or other sensitive configuration file paths to exfiltrate data from the host machine. The scope of the attack is constrained only by the filesystem permissions of the user account running the MetaGPT process. If the application is running with elevated privileges, the impact of the information disclosure is compounded, potentially exposing critical system secrets. This vulnerability requires no specific authentication, as the input processing logic is exposed to any mechanism that invokes the SPO data loading routines, effectively placing the vulnerability in the data processing layer of the extension."
}