CVE-2026-79407

MetaGPT 0.8.1 contains a path traversal flaw (CWE-22) in the SPO extension, in metagpt/ext/spo/utils/load.py, where set_file_name() and load_meta_data() join an attacker-controlled FILE_NAME value with the settings directory and open the resulting path without verifying it stays within the intended directory. By supplying a crafted FILE_NAME containing traversal sequences, an attacker can make the application read files outside the settings directory, such as configuration files, credentials, or other sensitive data on the host. The CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H) indicates the flaw is exploitable over a network without authentication or user interaction, with high confidentiality impact but no integrity or availability impact. Anyone running MetaGPT 0.8.1 with the SPO extension loaded, particularly in an application or service that passes untrusted FILE_NAME input to load_meta_data(), is affected. No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS currently estimates only about a 0.4% chance of exploitation in the next 30 days.

What to do: If you run MetaGPT 0.8.1 with the SPO extension, upgrade to a patched release when one is published (the fixed version is not stated in the available data) and, as an interim mitigation, reject or sanitize FILE_NAME values containing path separators or traversal sequences. Audit whether any application or service exposes set_file_name()/load_meta_data() to untrusted input, and consider enforcing that the resolved path remains within the settings directory; given the lack of a public PoC this can be prioritized accordingly, but monitor for updated advisories and patched releases.