Open-source package vulnerability · PyPI

CVE-2024-10831: DB-GPT Absolute Path Traversal vulnerability

criticalCVSS 3.0 9.1GHSA-hhw5-29f6-hf4x

In eosphoros-ai/db-gpt version 0.6.0, the endpoint for uploading files is vulnerable to absolute path traversal. This vulnerability allows an attacker to upload arbitrary files to arbitrary locations on the target server. The issue arises because the filekey and docfile.filename parameters are user-controllable, enabling the construction of paths outside the intended directory.

Published Mar 20, 2025 · Updated Mar 21, 2025

Affected packages

dbgpt

Ecosystem: PyPI
Affected: <= 0.6.0
Fixed in: No patched version yet
Check: pip show dbgpt

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

In eosphoros-ai/db-gpt version 0.6.0, the endpoint for uploading files is vulnerable to absolute path traversal. This vulnerability allows an attacker to upload arbitrary files to arbitrary locations on the target server. The issue arises because the file_key and doc_file.filename parameters are user-controllable, enabling the construction of paths outside the intended directory. This can lead to overwriting essential system files, such as SSH keys, for further exploitation.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More PyPI vulnerabilities

All PyPI entries