The vulnerability of the import_flow function in the framework for developing applications using large language models like db-gpt allows a hacker to execute arbitrary code.

The vulnerability of the importflow function in the framework for developing applications using large language models like db-gpt is related to an incorrect restriction on the path name to the restricted-access directory. Exploiting this vulnerability could allow a remote attacker to execute...

CVE-2025-6772

CVE-2025-6772 affects eosphoros-ai DB-GPT up to version 0.7.2. The vulnerability is in the import_flow function of /api/v2/serve/awel/flow/import, where manipulating the File argument enables directory traversal. This can lead to remote exploitation and potential access to files outside the inten...

CVE-2025-6772: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was found in eosphoros-ai db-gpt up to 0.7.2. It has been classified as critical. Affected is the function importflow of the file /api/v2/serve/awel/flow/import. The manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The exploi...