CVE-2025-51475

5.0 mediumEPSS 0.8%

Medium (5.0) in superagi superagi. EPSS 0.8% chance of exploitation in the next 30 days.

Arbitrary File Overwrite (AFO) in superagi.controllers.resources.upload in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to overwrite arbitrary files via unsanitised filenames submitted to the file upload endpoint, due to improper handling of directory traversal in os.path.join() and lack of path validation in get_root_input_dir().

Severity

CVSS 3.1

5.0 medium

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 56% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2025-07-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

superagi:superagi

References

https://github.com/TransformerOptimus/SuperAGI
https://github.com/TransformerOptimus/SuperAGI/pull/1463
https://www.gecko.security/blog/cve-2025-51475

Check your stack JSON