PT-2025-26244 · Unknown · Transformeroptimus/Superagi+1

Arashimuo · Published 2025-06-19 · Updated 2025-07-09 · CVE-2025-6280

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TransformerOptimus SuperAGI versions up to 0.0.14

Description A critical issue was found in the EmailToolKit component, specifically in the download attachment function of the file SuperAGI/superagi/helper/read email.py. The manipulation of the filename argument leads to path traversal. The issue has been publicly disclosed and may be exploited.

Recommendations For TransformerOptimus SuperAGI versions up to 0.0.14, consider disabling the download attachment function as a temporary workaround until a patch is available. Restrict access to the EmailToolKit component to minimize the risk of exploitation. Avoid using the filename argument in the affected function until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-6280

Affected Products

Emailtoolkit

Transformeroptimus/Superagi

References · 11

• 🔥 https://github.com/TransformerOptimus/SuperAGI/issues/1466 · Exploit
• https://osv.dev/vulnerability/CVE-2025-6280 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6280 · Security Note
• https://t.me/cvenotify/126185 · Telegram Post
• https://vuldb.com/?id.313284 · Note
• https://vuldb.com/?ctiid.313284 · Note
• https://t.me/cvenotify/128292 · Telegram Post
• https://vuldb.com/?submit.593614 · Note
• https://twitter.com/transilienceai/status/1935903042450178470 · Twitter Post
• https://t.me/cvetracker/26593 · Telegram Post
• https://twitter.com/CVEnew/status/1935815586409259496 · Twitter Post