DB-GPTGHSA-hhw5-29f6-hf4x
DB-GPT Absolute Path Traversal vulnerability
Critical9.1CVE-2024-10831 · Published Mar 20, 2025 · updated Jun 29, 2026
In eosphoros-ai/db-gpt version 0.6.0, the endpoint for uploading files is vulnerable to absolute path traversal. This vulnerability allows an attacker to upload arbitrary files to arbitrary locations on the target server. The issue arises because the `file_key` and `doc_file.filename` parameters are user-controllable, enabling the construction of paths outside the intended directory. This can lead to overwriting essential system files, such as SSH keys, for further exploitation.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| dbgpt PyPI | <= 0.6.0 | No fix yet |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-36
- Also known as
- CVE-2024-10831, PYSEC-2026-323
More DB-GPT advisories
All DB-GPT| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 202025 | DB-GPT vulnerable to Cross-Site Request Forgery High7.1Mar 20, 2025 | High7.1 | No fix yet |
| Mar 202025 | DB-GPT vulnerable to Arbitrary File Upload with Path TraversalCritical9.1Mar 20, 2025 | Critical9.1 | No fix yet |
| Mar 202025 | DB-GPT Uncontrolled Resource Consumption vulnerabilityHigh7.5Mar 20, 2025 | High7.5 | No fix yet |
| Mar 202025 | DB-GPT Arbitrary File Write vulnerabilityCritical9.1Mar 20, 2025 | Critical9.1 | No fix yet |
| Mar 202025 | DB-GPT Path Traversal vulnerabilityHigh8.2Mar 20, 2025 | High8.2 | No fix yet |
| Mar 202025 | DB-GPT Absolute Path Traversal in knowledge/{space_name}/document/uploadCritical9.1Mar 20, 2025 | Critical9.1 | 0.6.2 |