PT-2025-30455 · Unknown · Transformeroptimus/Superagi

Geckosecurity · Published 2025-07-22 · Updated 2025-07-22 · CVE-2025-51475

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TransformerOptimus SuperAGI version 0.0.14

Description An arbitrary file overwrite issue exists in the superagi.controllers.resources.upload component. This allows remote attackers to overwrite arbitrary files by submitting unsanitized filenames to the file upload endpoint. The issue is due to improper handling of directory traversal in os.path.join() and a lack of path validation in get root input dir().

Recommendations TransformerOptimus SuperAGI version 0.0.14: Implement robust path validation and sanitization for filenames uploaded through the file upload endpoint. Ensure that os.path.join() is used correctly to prevent directory traversal vulnerabilities.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-51475

Affected Products

Transformeroptimus/Superagi

References · 6

• 🔥 https://github.com/TransformerOptimus/SuperAGI/pull/1463 · Exploit
• 🔥 https://gecko.security/blog/cve-2025-51475 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-51475 · Security Note
• https://osv.dev/vulnerability/CVE-2025-51475 · Vendor Advisory
• https://github.com/TransformerOptimus/SuperAGI · Note
• https://twitter.com/CVEnew/status/1947743991178363345 · Twitter Post