CVE-2026-6615
Published: 20 April 2026
Summary
CVE-2026-6615 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validating and sanitizing the manipulated 'Name' argument in the Upload function to block path traversal sequences like '../'.
Mandates identification, reporting, and remediation of the specific path traversal flaw in superagi/controllers/resources.py, including compensating controls given vendor non-response.
Least privilege restricts the upload handler process to minimal file system access, limiting damage from successful path traversal to unintended locations.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in public-facing upload handler allows remote unauth file read (T1005) and arbitrary file write (T1105); directly exploitable as public-facing app vuln (T1190).
NVD Description
A weakness has been identified in TransformerOptimus SuperAGI up to 0.0.14. Affected by this issue is the function Upload of the file superagi/controllers/resources.py of the component Multipart Upload Handler. This manipulation of the argument Name causes path traversal. It is…
more
possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Deeper analysisAI
CVE-2026-6615 is a path traversal vulnerability (CWE-22) affecting TransformerOptimus SuperAGI versions up to 0.0.14. The flaw exists in the Upload function within the file superagi/controllers/resources.py, part of the Multipart Upload Handler component. Attackers can exploit it by manipulating the "Name" argument to traverse paths outside intended directories.
The vulnerability carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), making it exploitable remotely by unauthenticated attackers with low attack complexity and no user interaction required. Successful exploitation enables limited impacts on confidentiality, integrity, and availability, such as reading or modifying files in unintended locations.
Advisories referenced in VulDB entries (vuldb.com/vuln/358250 and related pages) detail the issue, while a GitHub Gist provides a public proof-of-concept exploit. The vendor was contacted early regarding disclosure but provided no response, and no patches or official mitigations are available in the provided references.
An exploit has been made publicly available and could be used for attacks, with no reported real-world exploitation status in the inputs.
Details
- CWE(s)