This vulnerability affects the Upload function in superagi/controllers/resources.py of TransformerOptimus SuperAGI up to version 0.0.14. By manipulating the Name argument, an attacker can perform path traversal, potentially accessing or overwriting files outside the intended directory. The attack can be initiated remotely without authentication or user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to low impact on confidentiality, integrity, and availability. The vendor has not issued any fix or advisory, and no official remediation is known.

Successful exploitation could allow an attacker to read or write files outside the designated upload directory, potentially leading to unauthorized data access or modification. However, the impact is rated medium due to limited confidentiality, integrity, and availability impacts as per the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing temporary mitigations such as input validation or restricting upload functionality until a patch is released.