Db-gpt vulnerabilities
10 known vulnerabilities in Db-gpt from Dbgpt. 10 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.2 High severity
eosphoros-ai/db-gpt: External Control of File Name or Path
eosphoros-ai/DB-GPT version latest is vulnerable to arbitrary file deletion on Windows systems via the '/v1/agent/hub/update' endpoint. The application fails to properly filter the '\' character, which is commonly used as a separator in Windows paths. This vul
- 8.1 High severity
eosphoros-ai/db-gpt: Cross-Site Request Forgery
In version 0.6.0 of eosphoros-ai/db-gpt, the `uvicorn` app created by `dbgpt_server` uses an overly permissive instance of `CORSMiddleware` which sets the `Access-Control-Allow-Origin` to `*` for all requests. This configuration makes all endpoints exposed by
- 9.8 Critical severity
eosphoros-ai/db-gpt: Improper Limitation of a Pathname to a Restricted Directory
In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /v1/personal/agent/upload` is vulnerable to Arbitrary File Upload with Path Traversal. This vulnerability allows unauthorized attackers to upload arbitrary files to the victim's file system at any locati
- 9.8 Critical severity
eosphoros-ai/db-gpt: Unrestricted Upload of File with Dangerous Type
In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /api/v1/editor/chart/run` allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write, enabling them to write ar
- 9.8 Critical severity
eosphoros-ai/db-gpt: Improper Neutralization of Special Elements used in an SQL Command
In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /api/v1/editor/sql/run` allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write using DuckDB SQL, enabling t
- 9.1 Critical severity
eosphoros-ai/db-gpt: External Control of File Name or Path
eosphoros-ai/db-gpt version 0.6.0 contains a vulnerability in the RAG-knowledge endpoint that allows for arbitrary file write. The issue arises from the ability to pass an absolute path to a call to `os.path.join`, enabling an attacker to write files to arbitr
- 9.1 Critical severity
eosphoros-ai/db-gpt: Absolute Path Traversal
eosphoros-ai/db-gpt version 0.6.0 is vulnerable to an arbitrary file write through the knowledge API. The endpoint for uploading files as 'knowledge' is susceptible to absolute path traversal, allowing attackers to write files to arbitrary locations on the tar
- 9.1 Critical severity
eosphoros-ai/db-gpt: Absolute Path Traversal
In eosphoros-ai/db-gpt version 0.6.0, the endpoint for uploading files is vulnerable to absolute path traversal. This vulnerability allows an attacker to upload arbitrary files to arbitrary locations on the target server. The issue arises because the `file_key
- 8.2 High severity
eosphoros-ai/db-gpt: Improper Limitation of a Pathname to a Restricted Directory
A Path Traversal vulnerability exists in the eosphoros-ai/db-gpt version 0.6.0 at the API endpoint `/v1/resource/file/delete`. This vulnerability allows an attacker to delete any file on the server by manipulating the `file_key` parameter. The `file_key` param
- 7.5 High severity
eosphoros-ai/db-gpt: Loop with Unreachable Exit Condition
A Denial of Service (DoS) vulnerability in the multipart request boundary processing mechanism of eosphoros-ai/db-gpt v0.6.0 allows unauthenticated attackers to cause excessive resource consumption. The server fails to handle excessive characters appended to t