CRITICAL9.1

PYSEC-2026-324

DB-GPT Absolute Path Traversal in knowledge/{space_name}/document/upload

Quick fix

PYSEC-2026-324 — dbgpt: upgrade to the fixed version with the command below.

pip install --upgrade 'dbgpt>=0.6.2'

Details

eosphoros-ai/db-gpt version 0.6.0 is vulnerable to an arbitrary file write through the knowledge API. The endpoint for uploading files as 'knowledge' is susceptible to absolute path traversal, allowing attackers to write files to arbitrary locations on the target server. This vulnerability arises because the 'doc_file.filename' parameter is user-controllable, enabling the construction of absolute paths.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/dbgpt

Introduced in: 0Fixed in: 0.6.2

Fixpip install --upgrade 'dbgpt>=0.6.2'

References

https://nvd.nist.gov/vuln/detail/CVE-2024-10833[ADVISORY]
https://github.com/eosphoros-ai/DB-GPT/commit/780ce803e325b87f4ddfbe5824451e379aeee56c[WEB]
https://github.com/eosphoros-ai/DB-GPT[PACKAGE]
https://huntr.com/bounties/dc58e981-e325-4c11-b4e1-1095890fd15a[WEB]
https://pypi.org/project/dbgpt[PACKAGE]
https://github.com/advisories/GHSA-j9g7-mqhh-9hxf[ADVISORY]