CVE-2026-59807

Medium

Description

Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows attackers to read and exfiltrate sensitive files by exploiting a missing assertSafeFileUploadPath check in the readFileFromDisk function within tool-file-uploads.ts. Attackers can exploit prompt injection to manipulate file_uploadable parameters to reference sensitive paths such as SSH private keys, causing the CLI to upload credential files to attacker-controlled storage.

SeverityMedium

CVSS6.8

Exploit probability—

ProductComposio

PublishedJul 8, 2026

First seenJul 8, 2026

Weakness typeCWE-73CWE-73

How to fix

Update

ComposioHQ composio0.2.32-beta.283 or later

Patches

github.com/ComposioHQ/composio/commit/fc17c37bf95b7ece5c038cb7e2ab7e3e4a064e3a

Vendor advisories

github.com/ComposioHQ/composio/releases/tag/%40composio%2Fcli%400.2.32-beta.283

Affected products

Product	Affected versions	Fixed in
ComposioHQ composio	v < 0.2.32-beta.283	0.2.32-beta.283

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.