CVE-2025-6280
TransformerOptimus SuperAGI EmailToolKit read_email.py download_attachment path traversal
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
TransformerOptimus SuperAGI EmailToolKit read_email.py download_attachment path traversal
A vulnerability, which was classified as critical, was found in TransformerOptimus SuperAGI up to 0.0.14. Affected is the function download_attachment of the file SuperAGI/superagi/helper/read_email.py of the component EmailToolKit. The manipulation of the argument filename leads to path traversal. The exploit has been disclosed to the public and may be used.
Es wurde eine Schwachstelle in TransformerOptimus SuperAGI bis 0.0.14 gefunden. Sie wurde als kritisch eingestuft. Betroffen hiervon ist die Funktion download_attachment der Datei SuperAGI/superagi/helper/read_email.py der Komponente EmailToolKit. Durch Manipulation des Arguments filename mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Der Exploit steht zur öffentlichen Verfügung.
| 2025-06-19: | Advisory disclosed |
| 2025-06-19: | VulDB entry created |
| 2025-06-19: | VulDB entry last update |
vuldb.com/?id.313284 (VDB-313284 | TransformerOptimus SuperAGI EmailToolKit read_email.py download_attachment path traversal)
vuldb.com/?ctiid.313284 (VDB-313284 | CTI Indicators (IOB, IOC, TTP, IOA))
vuldb.com/?submit.593614 (Submit #593614 | TransformerOptimus SuperAGI <=v0.0.14 Path Traversal)
github.com/TransformerOptimus/SuperAGI/issues/1466
Support options
