PT-2025-12072 · Unknown · Eosphoros-Ai/Db-Gpt
Published
2025-03-20
·
Updated
2025-03-20
·
CVE-2024-10834
CVSS v3.1
9.1
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
eosphoros-ai/db-gpt version 0.6.0
Description
The issue arises from the ability to pass an absolute path to a call to
os.path.join, enabling an attacker to write files to arbitrary locations on the target server. This can be exploited by setting the doc file.filename to an absolute path, which can lead to overwriting system files or creating new SSH-key entries. The vulnerability is located in the RAG-knowledge endpoint and allows for arbitrary file write.Recommendations
For eosphoros-ai/db-gpt version 0.6.0, as a temporary workaround, consider restricting access to the RAG-knowledge endpoint until a patch is available. Avoid using absolute paths in the
doc file.filename variable to minimize the risk of exploitation. Additionally, restrict the ability to write files to arbitrary locations on the target server by implementing proper input validation and sanitization for the os.path.join function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Eosphoros-Ai/Db-Gpt