CVE-2025-62616 is a critical server side request forgery flaw in the SendDiscordFileBlock of the AutoGPT Platform, scored CVSS 9.8. A user supplied URL was fetched without filtering. Fixed in autogpt-platform-beta-v0.6.34, so upgrade and limit the backend's outbound access.
What's affected
The GitHub advisory, published on 4 February 2026, lists autogpt-platform-beta-v0.6.33 and earlier as affected and v0.6.34 as patched. The record tags CWE-918.
Per the advisory, when a user gives the block a file value that starts with http or https, the code downloads it with an asynchronous HTTP client and no validation of where the address points. The advisory also notes that SSRF protection exists elsewhere in the repository, in a request wrapper used by the generic HTTP block, and recommends using that wrapper here instead.
The same release fixes CVE-2025-62615 in the RSS feed block.
How to check if you're exposed
Read the version of AutoGPT Platform from your image tag or git tag. At v0.6.33 or lower, you are affected.
Then decide who can use the Discord block. Reaching it needs the ability to create or edit an agent. Check which users hold that permission and whether your instance is open to sign ups.
Take a look at what the backend can reach on the network. The point of the fix is to stop requests to internal addresses, so test your egress rules from the backend container with a harmless internal address that you own.
What to do now
- Upgrade to v0.6.34 or later.
- Restrict agent creation to trusted users.
- Deny egress from the backend to loopback, private ranges and cloud metadata addresses.
- Prefer the platform's protected request wrapper in any custom block you write.
- Fix CVE-2025-62615 in the same change.
Why it matters
The class is CWE-918, server-side request forgery. The server downloads a file from a user chosen address, and requests that come from the server can reach places the user cannot. This block had the same weakness as the RSS block, a direct low level call without the project's own safe wrapper.
The lasting lesson is about consistency. A codebase that has a safe way to make requests should make the safe way the only way, for example by banning direct imports of low level clients in review rules. The KEV flag is false.
Quick check
How is this different from CVE-2025-62615?
It is the same weakness class in a different block. This one is the Discord file sender, and the other is the RSS feed reader. One upgrade fixes both.
Sources
Last reviewed: 19 October 2026.
