CVE-2024-10835

CVE-2024-10835 affects eosphoros-ai/db-gpt v0.6.0. The web API endpoint POST /api/v1/editor/sql/run allows executing arbitrary SQL without access control, enabling Arbitrary File Write via DuckDB SQL and potentially Remote Code Execution (RCE). Affected component: DB-GPT web API handler for edito...

CVE-2025-6772

CVE-2025-6772 affects eosphoros-ai DB-GPT up to version 0.7.2. The vulnerability is in the import_flow function of /api/v2/serve/awel/flow/import, where manipulating the File argument enables directory traversal. This can lead to remote exploitation and potential access to files outside the inten...

CVE-2025-0452

CVE-2025-0452 affects eosphoros-ai/DB-GPT (latest) and is described as vulnerable to arbitrary file deletion on Windows via the /v1/agent/hub/update endpoint. The root cause cited across sources is failure to properly filter the backslash character, a common Windows path separator, allowing manip...

CVE-2024-10831

CVE-2024-10831 — Normal (detailed): In eosphoros-ai/db-gpt version 0.6.0, the file-upload endpoint is vulnerable to absolute path traversal. The vulnerability arises because file_key and doc_file.filename are user-controllable, enabling an attacker to construct paths outside the intended director...

CVE-2024-10833

CVE-2024-10833 affects eosphoros-ai/db-gpt v0.6.0. The vulnerability is an absolute path traversal in the knowledge API’s file upload endpoint (knowledge/{space_name}/document/upload), where the user-controllable parameter doc_file.filename enables arbitrary file writes to locations on the target...

CVE-2024-10901

CVE-2024-10901 affects eosphoros-ai/db-gpt. In v0.6.0 (and earlier per OSV entry), the web API POST /api/v1/editor/chart/run allows executing arbitrary SQL without access controls, enabling Arbitrary File Write and potentially Remote Code Execution by writing files such as init .py into Python’s ...

CVE-2024-10902

CVE-2024-10902 concerns eosphoros-ai/db-gpt v0.6.0. The web API endpoint POST /v1/personal/agent/upload is described as vulnerable to Arbitrary File Upload with Path Traversal , enabling an attacker to upload files to arbitrary locations on the victim’s file system. Impact telegraphs possible rem...

CVE-2024-10906

CVE-2024-10906 – CSRF in DB-GPT (eosphoros-ai/db-gpt) Affected: db-gpt, version 0.6.0, within the uvicorn app created by dbgpt_server. Root cause: CORSMiddleware configured with wide permissiveness, setting Access-Control-Allow-Origin to ‘*’ for all endpoints. Impact: endpoints may be interacted ...

CVE-2024-10830

Summary: CVE-2024-10830 affects eosphoros-ai/db-gpt v0.6.0, exposing a path traversal in the API endpoint /v1/resource/file/delete that allows an attacker to delete arbitrary server files by manipulating the file_key parameter. The issue is caused by inadequate sanitization of file_key and is des...

CVE-2024-10829

CVE-2024-10829 describes a DoS in the multipart boundary handling of eosphoros-ai/db-gpt v0.6.0. Unauthenticated attackers can append excessive characters to multipart boundaries, causing an infinite loop and service-wide unavailability across endpoints that process multipart/form-data. The impac...

CVE-2024-10834

CVE-2024-10834 affects eosphoros-ai/db-gpt version 0.6.0, with a vulnerability in the RAG-knowledge endpoint that permits arbitrary file write by passing an absolute path to os.path.join via doc_file.filename. Attackers could write to arbitrary locations on the target server, potentially overwrit...

CVE-2025-51458

DB-GPT 0.7.0 is affected by a SQL injection in the editor_sql_run and query_ex paths. The vulnerability allows remote attackers to craft input to /v1/editor/sql/run and /v1/editor/chart/run that interacts with api_editor_v1.editor_sql_run, editor_chart_run, and datasource.rdbms.base.query_ex to e...

CVE-2025-51459

CVE-2025-51459 concerns DB-GPT 0.7.0 where a file-upload vulnerability in agent.hub.controller.refresh_plugins allows remote code execution via uploading a crafted plugin ZIP to /v1/personal/agent/upload. The root cause involves interaction with plugin_hub._sanitize_filename and plugins_util.scan...