What’s Vulnerable › Vulnerabilities

CVE-2025-51475

• Severity: medium (CVSS 5.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-07-22 · updated 2026-06-17
• Weakness: CWE-22

Description

Arbitrary File Overwrite (AFO) in superagi.controllers.resources.upload in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to overwrite arbitrary files via unsanitised filenames submitted to the file upload endpoint, due to improper handling of directory traversal in os.path.join() and lack of path validation in get_root_input_dir().

Affected products

• TransformerOptimus SuperAGI: 0.0.14

References

• https://github.com/TransformerOptimus/SuperAGI
• https://github.com/TransformerOptimus/SuperAGI/pull/1463
• https://www.gecko.security/blog/cve-2025-51475

Get alerted when CVE-2025-51475 or the next vulnerability affects your stack