CVE-2025-62616
SSRF Vulnerability in AutoGPT SendDiscordFileBlock Component
Publication date: 2026-02-04
Last updated on: 2026-02-17
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| agpt | autogpt_platform | to 0.6.34 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the AutoGPT platform prior to version autogpt-platform-beta-v0.6.34. Specifically, in the SendDiscordFileBlock component, the third-party library aiohttp.ClientSession().get is used to access URLs without filtering the input URL. This lack of input validation allows for a Server-Side Request Forgery (SSRF) vulnerability, where an attacker can manipulate the URL to make unauthorized requests from the server.
How can this vulnerability impact me? :
The SSRF vulnerability can allow an attacker to make the server perform unauthorized requests to internal or external systems. This can lead to exposure of sensitive information, unauthorized access to internal services, or potentially further exploitation of the network or system. Given the high CVSS score of 9.3, the impact is severe and can compromise the confidentiality and integrity of the affected system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the AutoGPT platform to version autogpt-platform-beta-v0.6.34 or later, where the SSRF issue in SendDiscordFileBlock has been patched.