CVE-2025-51475
Last modified
CVE-2025-51475 is a medium-severity vulnerability rated 5/10 on the CVSS scale. Arbitrary File Overwrite (AFO) in superagi.controllers.resources.upload in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to overwrite arbitrary files via unsanitised filenames submitted to the file upload endpoint, due to improper handling of directory traversal in os.path.join() and lack of path validation in get_root_input_dir().. EPSS estimates a 0.78% chance of exploitation in the next 30 days.
Description
Arbitrary File Overwrite (AFO) in superagi.controllers.resources.upload in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to overwrite arbitrary files via unsanitised filenames submitted to the file upload endpoint, due to improper handling of directory traversal in os.path.join() and lack of path validation in get_root_input_dir().
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Superagi | Superagi | 0.0.14 |
References
- https://github.com/TransformerOptimus/SuperAGI/pull/1463Exploit, Issue Tracking
- https://www.gecko.security/blog/cve-2025-51475Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-51475?
How severe is CVE-2025-51475?
How do I fix CVE-2025-51475?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-51462Stored Cross-site Scripting (XSS) vulnerability in api.apps.…6.1
- CVE-2025-51463Path Traversal in restore_run_backup() in AIM 3.28.0 allows …7
- CVE-2025-51464Cross-site Scripting (XSS) in aimhubio Aim 3.28.0 allows rem…8.8
- CVE-2025-5147A vulnerability was found in Netcore NBR1005GPEV2, NBR200V2 …6.3
- CVE-2025-51471Cross-Domain Token Exposure in server.auth.getAuthorizationT…6.9
- CVE-2025-51472Code Injection in AgentTemplate.eval_agent_config in Transfo…6.5
- CVE-2025-51479Authorization bypass in update_user_group in onyx-dot-app On…5.4
- CVE-2025-5148A vulnerability was found in FunAudioLLM InspireMusic up to …5.3
- CVE-2025-51480Path Traversal vulnerability in onnx.external_data_helper.sa…8.8
- CVE-2025-51481Local File Inclusion in dagster._grpc.impl.get_notebook_data…6.6
- CVE-2025-51482Remote Code Execution in letta.server.rest_api.routers.v1.to…8.8
- CVE-2025-51487A Stored Cross-Site Scripting (XSS) vulnerability exists in …4.5
Are you affected by CVE-2025-51475?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST