AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

DB-GPTGHSA-3xq5-x4fj-rff7

DB-GPT vulnerable to Arbitrary File Upload with Path Traversal

DB-GPT

CVE-2024-10902 · Published Mar 20, 2025 · updated Oct 27, 2026

Critical9.1
No fix yet
GitHub advisory

In eosphoros-ai/db-gpt version v0.6.0, the web API POST /v1/personal/agent/upload is vulnerable to Arbitrary File Upload with Path Traversal. This vulnerability allows unauthorized attackers to upload arbitrary files to the victim's file system at any location. The impact of this vulnerability includes the potential for remote code execution (RCE) by writing malicious files, such as a malicious __init__.py in the Python's /site-packages/ directory.

Affected versions

PackageAffectedFixed in
dbgpt
PyPI
<= 0.6.0No fix yet
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-22, CWE-73
Also known as
CVE-2024-10902, PYSEC-2026-321

More DB-GPT advisories

All DB-GPT
High 7.1Mar 20, 2025DB-GPT vulnerable to Cross-Site Request ForgeryCVE-2024-10906no fix yetHigh 7.5Mar 20, 2025DB-GPT Uncontrolled Resource Consumption vulnerabilityCVE-2024-10829no fix yetCritical 9.1Mar 20, 2025DB-GPT Arbitrary File Write vulnerabilityCVE-2024-10901no fix yetHigh 8.2Mar 20, 2025DB-GPT Path Traversal vulnerabilityCVE-2024-10830no fix yetCritical 9.1Mar 20, 2025DB-GPT Absolute Path Traversal vulnerabilityCVE-2024-10831no fix yetCritical 9.1Mar 20, 2025DB-GPT Absolute Path Traversal in knowledge/{space_name}/document/uploadCVE-2024-10833fixed in 0.6.2