Open-source package vulnerability · PyPI

CVE-2024-10833: DB-GPT Absolute Path Traversal in knowledge/{space_name}/document/upload

criticalCVSS 3.0 9.1GHSA-j9g7-mqhh-9hxf

eosphoros-ai/db-gpt version 0.6.0 is vulnerable to an arbitrary file write through the knowledge API. The endpoint for uploading files as 'knowledge' is susceptible to absolute path traversal, allowing attackers to write files to arbitrary locations on the target server. This vulnerability arises because the 'docfile.filename' parameter is user-controllable, enabling the construction of absolute paths.

Published Mar 20, 2025 · Updated Oct 15, 2025

Affected packages

dbgpt

Ecosystem: PyPI
Affected: < 0.6.2
Fixed in: 0.6.2
Check: pip show dbgpt

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

eosphoros-ai/db-gpt version 0.6.0 is vulnerable to an arbitrary file write through the knowledge API. The endpoint for uploading files as 'knowledge' is susceptible to absolute path traversal, allowing attackers to write files to arbitrary locations on the target server. This vulnerability arises because the 'doc_file.filename' parameter is user-controllable, enabling the construction of absolute paths.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More PyPI vulnerabilities

All PyPI entries