CVE-2026-79407: n/a

This vulnerability exists in MetaGPT 0.8.1's SPO extension, specifically in the functions set_file_name() and load_meta_data() within metagpt/ext/spo/utils/load.py. The code joins an attacker-controlled FILE_NAME value with the settings directory path and opens the resulting file path without proper validation to ensure it remains within the intended directory. This lack of path traversal protection (CWE-22) enables an attacker to read arbitrary files on the system.

An attacker can read arbitrary files on the system where MetaGPT 0.8.1 is deployed by exploiting the path traversal flaw. This can lead to disclosure of sensitive information. The CVSS score is 7.5 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing the vulnerable SPO extension to untrusted users or inputs. Implement input validation or path normalization to ensure FILE_NAME values cannot escape the intended directory.