PT-2025-12070 · Unknown · Eosphoros-Ai/Db-Gpt

Published 2025-03-20 · Updated 2025-03-21 · CVE-2024-10831

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions eosphoros-ai/db-gpt version 0.6.0

Description The issue arises because the file key and doc file.filename parameters are user-controllable, enabling the construction of paths outside the intended directory. This can lead to overwriting essential system files, such as SSH keys, for further exploitation. The endpoint for uploading files is vulnerable to absolute path traversal, allowing an attacker to upload arbitrary files to arbitrary locations on the target server.

Recommendations For version 0.6.0, as a temporary workaround, consider restricting access to the file upload endpoint until a patch is available. Avoid using the file key and doc file.filename parameters in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-36

Related Identifiers

CVE-2024-10831

GHSA-HHW5-29F6-HF4X

Affected Products

Eosphoros-Ai/Db-Gpt

References · 6

• 🔥 https://huntr.com/bounties/5c34c39f-66d4-414c-ab6a-f7888a5d882a · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-10831 · Security Note
• https://osv.dev/vulnerability/CVE-2024-10831 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hhw5-29f6-hf4x · Vendor Advisory
• https://github.com/eosphoros-ai/DB-GPT · Note
• https://twitter.com/CVEnew/status/1903082104780476786 · Twitter Post