CVE Intelligence
Analysis AI-assisted

CVE-2025-62616: AutoGPT Platform SSRF in SendDiscordFileBlock

AutoGPT Platform versions before autogpt-platform-beta-v0.6.34 contain a server-side request forgery (SSRF) flaw in SendDiscordFileBlock, where a supplied URL is fetched without filtering. The advisory states the issue is patched in v0.6.34, and NVD scores it 9.8 (CVSS 3.1, critical). No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

AutoGPT is a platform for building, deploying and managing continuous AI agents that automate workflows. CVE-2025-62616 affects the SendDiscordFileBlock component, which fetches a supplied URL using aiohttp without filtering that URL, enabling server-side request forgery (CWE-918).

Impact

  • An attacker who can influence the URL processed by the block may cause the platform server to send requests to destinations the attacker chooses.
  • Depending on the deployment network, this could reach internal services not exposed to the internet. The actual reach depends on the environment, which the record does not describe.
  • NVD rates the base score 9.8 (CVSS 3.1, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). GitHub, as CNA, lists 9.3 under CVSS 4.0.

Affected products and versions

  • Product: Agpt Autogpt Platform.
  • Affected range: versions before 0.6.34, as recorded in the CVE data.
  • The record states the issue is patched in autogpt-platform-beta-v0.6.34. The structured fix field is empty, so the fixed version is taken from the description only.

Exploitation status

CISA KEV does not list this CVE. No confirmed exploitation in the wild appears in the sources consulted. The GitHub reference carries an Exploit tag, but that tag alone does not establish real-world exploitation. EPSS data is not available in the record.

Remediation and mitigation

  • Upgrade AutoGPT Platform to autogpt-platform-beta-v0.6.34 or later.
  • Until the upgrade is applied, restrict which users can create or edit workflows that use the Discord file block.
  • Limit outbound network access from the platform host so it cannot reach internal management interfaces or metadata services unnecessarily.
  • Review the GitHub security advisory for authoritative guidance: GHSA-ggc4-4fmm-9hmc.

Detection guidance

  • Review workflow definitions that use Discord file blocks with URLs taken from untrusted inputs.
  • Monitor the platform's outbound HTTP traffic for requests to private, loopback or link-local address ranges originating from the agent runtime.
  • Keep logs of block executions so unusual target hosts can be correlated with workflow runs.

Limitations of the available information

The record does not state the exact prerequisites for exploitation within the platform, the full list of patched branches, the EPSS score, or any proof of exploitation. These are unknown from the sources consulted. The NVD entry is the authoritative CVSS source for this record.

Frequently asked questions

Which AutoGPT Platform versions are affected by CVE-2025-62616?

The record lists the affected range as versions before 0.6.34. The advisory states the issue is patched in autogpt-platform-beta-v0.6.34.

Is this vulnerability being actively exploited?

CISA KEV does not list this CVE, and no confirmed exploitation in the wild appears in the sources consulted. The GitHub reference has an Exploit tag, which does not by itself prove real-world use.

What should administrators do now?

Upgrade to autogpt-platform-beta-v0.6.34 or later, restrict who can create or edit workflows using the Discord file block, and limit outbound network access from the platform host.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.