Safety vulnerability ID: 76289
The information on this page was manually curated by our Cybersecurity Intelligence Team.
In eosphoros-ai/db-gpt version 0.6.0, the endpoint for uploading files is vulnerable to absolute path traversal. This vulnerability allows an attacker to upload arbitrary files to arbitrary locations on the target server. The issue arises because the file_key and doc_file.filename parameters are user-controllable, enabling the construction of paths outside the intended directory. This can lead to overwriting essential system files, such as SSH keys, for further exploitation.
Latest version: 0.7.0
DB-GPT is an experimental open-source project that uses localized GPT large models to interact with your data and environment. With this solution, you can beassured that there is no risk of data leakage, and your data is 100% private and secure.
This vulnerability has no description
Scan your Python project for dependency vulnerabilities in two minutes
Scan your application