Composio SDK Path Validation Bypass Enabling Prompt-Injection-Driven File Exfiltration

Technical Analysis

The vulnerability resides in the readFileFromDisk function within tool-file-uploads.ts, which lacks the assertSafeFileUploadPath check used elsewhere to prevent path traversal. An attacker can craft a prompt injection payload (delivered through any untrusted content the agent processes, such as a webpage, document, or tool response) that manipulates the file_uploadable parameter passed to the file upload tool, pointing it at sensitive paths like ~/.ssh/id_rsa. Because the LLM-driven agent treats tool parameters as data to be filled based on its reasoning, the missing server-side path validation allows the injected instruction to cross the trust boundary between untrusted content and privileged filesystem access, resulting in exfiltration of credential material to an attacker-controlled endpoint via the legitimate upload mechanism.

Affected Systems

Composio SDK

Detection Signatures

• Log entries showing file_uploadable parameters referencing paths outside expected working directories (e.g., /.ssh/, /etc/, /home/*/.aws/)
• Calls to readFileFromDisk with absolute or traversal paths (../, ~/) not matching allowlisted upload directories
• Unexpected outbound uploads to unfamiliar storage endpoints immediately following tool invocation
• Prompt/tool-call content containing instructions referencing credential file names (id_rsa, .pem, .env, credentials.json) within untrusted input sources

Remediation Steps

1. 1

   Upgrade Composio SDK

   Update to version 0.2.32-beta.283 or later, which restores the assertSafeFileUploadPath validation in tool-file-uploads.ts.

2. 2

   Enforce path allowlisting

   Independently validate that any file path passed to upload tools resolves within an approved directory before executing readFileFromDisk, regardless of SDK-level checks.

3. 3

   Sanitize and constrain tool parameters

   Apply strict schema validation and canonicalization on file_uploadable and similar path-bearing parameters to reject absolute paths, traversal sequences, and references to known sensitive file patterns.

4. 4

   Isolate agent filesystem access

   Run agents with least-privilege filesystem permissions or in sandboxed/containerized environments so SSH keys and other credentials are not reachable even if path validation fails.

5. 5

   Monitor for injection indicators

   Deploy content filtering and logging on untrusted inputs (web pages, documents, tool outputs) to detect instructions attempting to redirect file operations toward credential paths.