← Back

CVE-2025-51475

nvd nist
Published: Jul 22, 2025Modified: Jun 17, 2026

JSON object

Loading...
5.0
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Exploitability: 1.3 / Impact: 3.6
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Arbitrary File Overwrite (AFO) in superagi.controllers.resources.upload in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to overwrite arbitrary files via unsanitised filenames submitted to the file upload endpoint, due to improper handling of directory traversal in os.path.join() and lack of path validation in get_root_input_dir().

Affected (1)

Products: Superagi: Superagi
Superagi
1 product
Superagi
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Superagi
Version 0.0.14

Related CWEs

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (3)

Source: cve@mitre.org
Product
Source: cve@mitre.org
ExploitIssue Tracking
Source: cve@mitre.org
ExploitThird Party Advisory

Timeline

No history available yet.