PatchSiren

ComposioHQ CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH ComposioHQ CVE published 2026-07-08

CVE-2026-59807

CVE-2026-59807 is a high-severity vulnerability in Composio SDK before 0.2.32-beta.283. The vulnerability allows attackers to read and exfiltrate sensitive files by exploiting a missing assertSafeFileUploadPath check in the readFileFromDisk function within tool-file-uploads.ts. Attackers can exploit prompt injection to manipulate file_uploadable parameters to reference sensitive paths such as SSH private [truncated]