CVE-2025-32422: AutoGPT has a DoS vulnerability in FileStoreBlock with StepThroughItemsBlock
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, StepThroughItemsBlock can iterate all the contents in a list and send them to FileStoreBlock for downloading one by one. Although FileStoreBlock has access time limits for downloading files, StepThroughItemsBlock can be used to slowly iterate and download relatively small files (e.g., 100M) multiple times. StepThroughItemsBlock does not limit the number of loops. In addition, FileStoreBlock does not limit the amount of disk space consumed in the current working directory. When a malicious user chooses to download too many videos, the disk space will eventually run out, causing a DoS. Version 0.6.63 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AutoGPTto a version that resolves this vulnerability.Fixed in 0.6.63
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32422?
CVE-2025-32422 has a severity rating of high, specifically 8.7 on the CVSS scale.
What type of vulnerability is CVE-2025-32422?
CVE-2025-32422 is a denial of service (DoS) vulnerability affecting the FileStoreBlock component in AutoGPT.
How do I fix CVE-2025-32422?
To fix CVE-2025-32422, you should update AutoGPT to version 0.6.63 or later.
What impact does CVE-2025-32422 have on AutoGPT?
The vulnerability allows continuous iterations that can overwhelm the FileStoreBlock, potentially causing service interruptions.
When was CVE-2025-32422 published?
CVE-2025-32422 was published on June 18, 2026.