GitHub Advisoryadvisory · PyPI

GHSA-j9g7-mqhh-9hxf DB-GPT Absolute Path Traversal in knowledge/{space_name}/document/upload

CRITICAL Published 2025-03-20 Modified 2026-10-27 Official page ↗
Aliases
CVE-2024-10833
Ecosystem
PyPI
Packages
dbgpt
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weaknesses
CWE-22, CWE-36
Reviewed
2025-03-21

Affected packages

• PyPI dbgpt: < 0.6.2 → fixed in 0.6.2

Description

eosphoros-ai/db-gpt version 0.6.0 is vulnerable to an arbitrary file write through the knowledge API. The endpoint for uploading files as 'knowledge' is susceptible to absolute path traversal, allowing attackers to write files to arbitrary locations on the target server. This vulnerability arises because the 'doc_file.filename' parameter is user-controllable, enabling the construction of absolute paths.

Related

Alias · CVE (1)

  • CVE-2024-10833 eosphoros-ai/db-gpt version 0.6.0 is vulnerable to an arbitrary file write through the knowledge API. vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-36 Absolute Path Traversal weakness

References