{"id":"CVE-2024-9415","aliases":["EUVD-2025-6851","GHSA-959v-wfjp-7c37"],"status":"published","title":"Path Traversal in transformeroptimus/superagi","description":"A Path Traversal vulnerability exists in the file upload functionality of transformeroptimus/superagi version 0.0.14. This vulnerability allows an attacker to upload an arbitrary file to the server, potentially leading to remote code execution or overwriting any file on the server.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0149,"percentile":0.74324,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2025-03-20T10:09:06Z","modified":"2026-10-28T02:30:58Z","products":[{"vendor":"superagi","product":"superagi"},{"vendor":"transformeroptimus","product":"transformeroptimus/superagi"}],"references":[{"url":"https://huntr.com/bounties/31bdf98c-5205-4c48-9bc7-9e780ba63398","tags":["Exploit","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9415","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-959v-wfjp-7c37"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/9xxx/CVE-2024-9415.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-9415","title":"Path Traversal in transformeroptimus/superagi","description":"A Path Traversal vulnerability exists in the file upload functionality of transformeroptimus/superagi version 0.0.14. This vulnerability allows an attacker to upload an arbitrary file to the server, potentially leading to remote code execution or overwriting any file on the server.","status":"published","published":"2025-03-20T10:09:06.219Z","modified":"2025-03-20T18:58:16.596Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:05.823187Z"}],"euvd":[{"id":"EUVD-2025-6851","description":"A Path Traversal vulnerability exists in the file upload functionality of transformeroptimus/superagi version 0.0.14. This vulnerability allows an attacker to upload an arbitrary file to the server, potentially leading to remote code execution or overwriting any file on the server.","status":"published","published":"2025-03-20T10:09:06Z","modified":"2025-03-20T18:58:16Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:56.973752Z"}],"ghsa":[{"id":"GHSA-959v-wfjp-7c37","title":"A Path Traversal vulnerability exists in the file upload functionality of transformeroptimus...","description":"A Path Traversal vulnerability exists in the file upload functionality of transformeroptimus/superagi version 0.0.14. This vulnerability allows an attacker to upload an arbitrary file to the server, potentially leading to remote code execution or overwriting any file on the server.","status":"published","published":"2025-03-20T12:32:51Z","modified":"2025-03-20T12:32:51Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:00:23.060957Z"}],"nvd":[{"id":"CVE-2024-9415","description":"A Path Traversal vulnerability exists in the file upload functionality of transformeroptimus/superagi version 0.0.14. This vulnerability allows an attacker to upload an arbitrary file to the server, potentially leading to remote code execution or overwriting any file on the server.","status":"published","published":"2025-03-20T10:15:48.58Z","modified":"2026-06-17T08:24:31.82Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:10:45.815983Z"}],"osv":[{"id":"CVE-2024-9415","title":"Path Traversal in transformeroptimus/superagi","description":"A Path Traversal vulnerability exists in the file upload functionality of transformeroptimus/superagi version 0.0.14. This vulnerability allows an attacker to upload an arbitrary file to the server, potentially leading to remote code execution or overwriting any file on the server.","status":"published","published":"2025-03-20T10:09:06.219Z","modified":"2026-10-28T02:30:58.729732158Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:45.712478Z"}]}}