CVE-2026-6615

Summary

A weakness has been identified in TransformerOptimus SuperAGI up to 0.0.14. Affected by this issue is the function Upload of the file superagi/controllers/resources.py of the component Multipart Upload Handler. This manipulation of the argument Name causes path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

VendorProductVersion RangeStatus
TransformerOptimusSuperAGI0.0.1affected
TransformerOptimusSuperAGI0.0.2affected
TransformerOptimusSuperAGI0.0.3affected
TransformerOptimusSuperAGI0.0.4affected
TransformerOptimusSuperAGI0.0.5affected
TransformerOptimusSuperAGI0.0.6affected
TransformerOptimusSuperAGI0.0.7affected
TransformerOptimusSuperAGI0.0.8affected
TransformerOptimusSuperAGI0.0.9affected
TransformerOptimusSuperAGI0.0.10affected
TransformerOptimusSuperAGI0.0.11affected
TransformerOptimusSuperAGI0.0.12affected
TransformerOptimusSuperAGI0.0.13affected
TransformerOptimusSuperAGI0.0.14affected

Weaknesses

  • CWE-22: Path Traversal

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: yes
    • Technical Impact: partial

References