Path Traversal in SuperAGI Exploitable Remotely

The National Vulnerability Database has identified a critical path traversal vulnerability (CVE-2026-6615) in TransformerOptimus SuperAGI, affecting versions up to 0.0.14. The flaw resides within the Multipart Upload Handler’s file upload functionality in superagi/controllers/resources.py. Attackers can exploit this by manipulating the ‘Name’ argument to traverse directories, potentially accessing or overwriting sensitive files on the server. This vulnerability is remotely exploitable and a public exploit is available, increasing the immediate risk to organizations using affected versions.

Despite early disclosure, the vendor has not responded, leaving users exposed. With a CVSS score of 7.3 (HIGH), this is not a vulnerability to ignore. Defenders must prioritize patching or mitigating this issue immediately, as unpatched systems present an open door for attackers to compromise their environment. The lack of vendor response underscores the importance of proactive security measures and contingency planning when relying on third-party software.