A weakness has been identified in TransformerOptimus SuperAGI up to 0.0.14. Affected by this issue is the function Upload of the file superagi/controllers/resources.py of the component Multipart Upload Handler. This manipulation of the argument Name causes path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-6615 is a path traversal vulnerability in TransformerOptimus SuperAGI versions up to 0.0.14 affecting the multipart upload handler. An attacker can manipulate the Name argument to traverse directories and potentially access or write arbitrary files on the system.
تؤثر هذه الثغرة على معالج التحميل متعدد الأجزاء في ملف superagi/controllers/resources.py حيث يمكن للمهاجمين التلاعب بمعامل Name لتنفيذ هجمات اجتياز المسار. يمكن تنفيذ الهجوم عن بعد وقد تم نشر الاستغلال علناً مما يزيد من خطر الاستخدام الفعلي.
This vulnerability allows remote attackers to exploit a path traversal flaw in SuperAGI's file upload functionality by manipulating the Name parameter. The weakness enables unauthorized file access and potential system compromise through directory traversal techniques.
Upgrade TransformerOptimus SuperAGI to version 0.0.15 or later immediately. Implement input validation and sanitization for all file upload parameters, particularly the Name argument. Apply strict path normalization to prevent directory traversal attacks. Deploy Web Application Firewall (WAF) rules to detect and block path traversal attempts. Restrict file upload permissions to designated directories only.
قم بترقية TransformerOptimus SuperAGI إلى الإصدار 0.0.15 أو أحدث فوراً. طبق التحقق من صحة المدخلات وتنظيفها لجميع معاملات تحميل الملفات خاصة معامل Name. طبق تطبيع المسار الصارم لمنع هجمات اجتياز المجلدات. نشر قواعد جدار حماية تطبيقات الويب للكشف عن محاولات اجتياز المسار وحجبها. قيد أذونات تحميل الملفات على المجلدات المخصصة فقط.