A directory traversal vulnerability in ComposioHQ version 0.7.20 allows unauthenticated attackers to read sensitive system files, posing a high risk of information disclosure.

The vulnerability exists within the _download_file_or_dir function, where improper input validation allows an unauthenticated remote attacker to traverse the file system and retrieve unauthorized data.

This vulnerability carries a CVSS score of 7.5, indicating a high severity risk that could lead to the exposure of sensitive configuration files, credentials, or proprietary source code. The ability for an unauthenticated attacker to remotely access the file system could result in significant data breaches, intellectual property theft, and a compromise of the overall integrity of the development environment.

Immediate Action: As no official patch is currently listed, administrators should immediately restrict access to the affected Composio server endpoints and monitor for unusual file access patterns.

Proactive Monitoring: Review web server and application logs for suspicious directory traversal sequences, such as multiple occurrences of dot-dot-slash patterns, directed toward the API endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing directory traversal characters that attempt to access restricted paths or sensitive system files.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by TOAST-Research.

Given the high CVSS score and the public availability of a proof-of-concept, this vulnerability should be treated with urgency. Since an official patch is not yet available, organizations must prioritize network-level restrictions and WAF configurations to prevent exploitation until a formal security update is released by the vendor.