Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai
CVE-2024-10831Arbitrary File Write through Absolute Path Traversal in eosphoros-ai/db-gpt
Critical 9.1
In plain English
A critical-severity security flaw in eosphoros-ai/db-gpt from eosphoros-ai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).
Official description
In eosphoros-ai/db-gpt version 0.6.0, the endpoint for uploading files is vulnerable to absolute path traversal. This vulnerability allows an attacker to upload arbitrary files to arbitrary locations on the target server. The issue arises because the `file_key` and `doc_file.filename` parameters are user-controllable, enabling the construction of paths outside the intended directory. This can lead to overwriting essential system files, such as SSH keys, for further exploitation.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | dbgpt | no fix listed | GHSA-hhw5-29f6-hf4x |
| PyPI | dbgpt | no fix listed | PYSEC-2026-323 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| eosphoros-ai | eosphoros-ai/db-gpt | unspecified – through latest |
Weakness: CWE-36 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H