CVE-2020-4039: Fossasia Susi.ai

Critical severity, CVSS 9.1. EPSS: 1.4% chance of exploitation in the next 30 days.

SUSI.AI is an intelligent Open Source personal assistant. SUSI.AI Server before version d27ed0f has a directory traversal vulnerability due to insufficient input validation. Any admin config and file readable by the app can be retrieved by the attacker. Furthermore, some files can also be moved or deleted.

Affected products

• Fossasia Susi.ai: before 2020-05-13 (fixed in 2020-05-13)

Published 2021-04-30. Last modified 2026-06-17.