Open-source package vulnerability · PyPI

CVE-2024-10902: DB-GPT vulnerable to Arbitrary File Upload with Path Traversal

criticalCVSS 3.0 9.1GHSA-3xq5-x4fj-rff7

In eosphoros-ai/db-gpt version v0.6.0, the web API POST /v1/personal/agent/upload is vulnerable to Arbitrary File Upload with Path Traversal. This vulnerability allows unauthorized attackers to upload arbitrary files to the victim's file system at any location.

Published Mar 20, 2025 · Updated Oct 15, 2025

Affected packages

dbgpt

Ecosystem: PyPI
Affected: <= 0.6.0
Fixed in: No patched version yet
Check: pip show dbgpt

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

In eosphoros-ai/db-gpt version v0.6.0, the web API POST /v1/personal/agent/upload is vulnerable to Arbitrary File Upload with Path Traversal. This vulnerability allows unauthorized attackers to upload arbitrary files to the victim's file system at any location. The impact of this vulnerability includes the potential for remote code execution (RCE) by writing malicious files, such as a malicious __init__.py in the Python's /site-packages/ directory.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More PyPI vulnerabilities

All PyPI entries