CVE-2025-6772

🗓️ 27 Jun 2025 18:31:05Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 49 Views🌐 WEB

Critical path traversal vulnerability in eosphoros-ai db-gpt affects import_flow function allowing remote attack

Reporter	Title	Published	Views	Family All 12
BDU FSTEC	The vulnerability of the import_flow function in the framework for developing applications using large language models like db-gpt allows a hacker to execute arbitrary code.	16 Dec 202500:00	–	bdu_fstec
Circl	CVE-2025-6772	27 Jun 202518:51	–	circl
CNNVD	DB-GPT 路径遍历漏洞	27 Jun 202500:00	–	cnnvd
Cvelist	CVE-2025-6772 eosphoros-ai db-gpt import import_flow path traversal	27 Jun 202518:31	–	cvelist
EUVD	EUVD-2025-19420	3 Oct 202520:07	–	euvd
NVD	CVE-2025-6772	27 Jun 202519:15	–	nvd
OSV	CVE-2025-6772 eosphoros-ai db-gpt import import_flow path traversal	27 Jun 202518:31	–	osv
Positive Technologies	PT-2025-27251	27 Jun 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-6772	29 Jun 202519:07	–	redhatcve
Snyk	Directory Traversal	27 Jun 202518:46	–	snyk

NVD

Vulners

Node

dbgpt db-gptRange≤0.7.2

[
  {
    "vendor": "eosphoros-ai",
    "product": "db-gpt",
    "versions": [
      {
        "version": "0.7.0",
        "status": "affected"
      },
      {
        "version": "0.7.1",
        "status": "affected"
      },
      {
        "version": "0.7.2",
        "status": "affected"
      }
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
github	www.github.com/eosphoros-ai/DB-GPT/issues/2774
vuldb	www.vuldb.com/

Parameter	Position	Path	Description	CWE
File	request body	/api/v2/serve/awel/flow/import	Path traversal via File parameter in import_flow allows remote attacker to access arbitrary files.	CWE-22

17 Jun 2026 10:02Current

7.2High risk

Vulners AI Score7.2

CVSS 3.17.3 - 7.5

CVSS 46.9

CVSS 27.5

CVSS 37.3

EPSS0.00523

SSVC

CWE-22

vulnerability path traversal eosphoros-ai db-gpt import_flow remote attack