PT-2025-12071 · Unknown · Eosphoros-Ai/Db-Gpt

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-10833

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions eosphoros-ai/db-gpt version 0.6.0

Description The issue arises from an arbitrary file write vulnerability through the knowledge API, specifically due to the susceptibility of the file upload endpoint to absolute path traversal. This allows attackers to write files to arbitrary locations on the target server. The doc file.filename parameter is user-controllable, which enables the construction of absolute paths, leading to this vulnerability.

Recommendations For eosphoros-ai/db-gpt version 0.6.0, consider restricting access to the knowledge API endpoint to minimize the risk of exploitation. As a temporary workaround, avoid using the doc file.filename parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-36

Related Identifiers

CVE-2024-10833

GHSA-J9G7-MQHH-9HXF

Affected Products

Eosphoros-Ai/Db-Gpt

References · 7

• 🔥 https://huntr.com/bounties/dc58e981-e325-4c11-b4e1-1095890fd15a · Exploit
• https://osv.dev/vulnerability/GHSA-j9g7-mqhh-9hxf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10833 · Security Note
• https://osv.dev/vulnerability/CVE-2024-10833 · Vendor Advisory
• https://github.com/eosphoros-ai/DB-GPT · Note
• https://github.com/eosphoros-ai/DB-GPT/commit/780ce803e325b87f4ddfbe5824451e379aeee56c · Note
• https://twitter.com/CVEnew/status/1902671137948963322 · Twitter Post