Arbitrary File Overwrite Vulnerability in TransformerOptimus by TransformerOptimus
CVE-2025-51475

5MEDIUM

Key Information:

Vendor

TransformerOptimus

Status
TransformerOptimus
Vendor
CVE Published:
22 July 2025

What is CVE-2025-51475?

An arbitrary file overwrite vulnerability exists in the file upload functionality of TransformerOptimus SuperAGI 0.0.14. This security flaw allows remote attackers to exploit unsanitized filename submissions to the upload endpoint, leading to unauthorized overwriting of files. The issue arises from inadequate directory traversal handling within the os.path.join() function, coupled with insufficient path validation in the get_root_input_dir() method. As a result, attackers can manipulate file paths to overwrite sensitive files, posing significant risks to the integrity and confidentiality of affected systems.

References

https://github.com/TransformerOptimus/SuperAGI
https://github.com/TransformerOptimus/SuperAGI/pull/1463
https://www.gecko.security/blog/cve-2025-51475

CVSS V3.1

Score:
5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.