Superagi CVE-2026-6615

Exploitation requires the SuperAGI application's /resources upload endpoint (superagi/controllers/resources.py Upload function) to be network-accessible to the attacker. No authentication is required (PR:N in CVSS vector). No user interaction needed (UI:N). The vulnerability affects the multipart file upload handler specifically, so any deployment exposing this functionality is vulnerable. Limiting factors: Impact scope (S:U - unchanged) suggests exploitation is confined to resources accessible by the SuperAGI process user account, not full system compromise. Actual file system damage depends on process permissions and operating system file access controls. Deployments running SuperAGI as a low-privilege user with restricted write permissions will limit impact compared to root/administrator execution.

Real-world risk is moderate-high due to the network attack vector (AV:N), low complexity (AC:L), and zero authentication requirement (PR:N). The publicly available exploit (GitHub Gist by YLChen-007) significantly lowers the barrier to exploitation - script kiddies can weaponize this without deep technical knowledge. However, CVSS impact ratings of Low/Low/Low (C:L/I:L/A:L) suggest exploitability may be constrained by application context, possibly limited to reading/writing files within the SuperAGI process's permissions or affecting only uploaded resources rather than system-wide files. The CVSS temporal metrics show Exploit Maturity as Proof-of-Concept (E:P) and Remediation Level as Workaround (RL:X - unavailable/unknown), indicating no vendor-provided patch at time of VulDB disclosure. Vendor non-responsiveness is a red flag for unmaintained software risk. Not being in CISA KEV suggests no observed mass exploitation yet, but the combination of unauthenticated network access + public POC + unresponsive vendor creates a ticking clock for opportunistic attacks. Organizations running SuperAGI should treat this as HIGH priority if the application is internet-facing or processes untrusted uploads, MEDIUM priority for internal-only deployments with trusted users.

Attacker sends a crafted HTTP POST request to the SuperAGI /resources upload endpoint with a multipart form containing a manipulated 'Name' parameter such as '../../../../etc/passwd' or '../../../app/config/secrets.json'. The vulnerable Upload function in resources.py processes this without sanitization, writing uploaded content to or reading from the traversed path outside the intended upload directory. Attacker could exfiltrate sensitive configuration files, overwrite application code to achieve persistence, or delete critical resources causing denial of service. Public POC exists on GitHub Gist, enabling even low-skill attackers to execute this.