HIGH8.2

PYSEC-2026-1291

DB-GPT Path Traversal vulnerability

Details

A Path Traversal vulnerability exists in the eosphoros-ai/db-gpt version 0.6.0 at the API endpoint `/v1/resource/file/delete`. This vulnerability allows an attacker to delete any file on the server by manipulating the `file_key` parameter. The `file_key` parameter is not properly sanitized, enabling an attacker to specify arbitrary file paths. If the specified file exists, the application will delete it.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/dbgpt

Introduced in: 0

No fixed version published yet for dbgpt (pip). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-10830[ADVISORY]
https://github.com/eosphoros-ai/DB-GPT[PACKAGE]
https://huntr.com/bounties/26adf08a-9262-4d5a-a2ee-ce12ed919620[WEB]
https://pypi.org/project/dbgpt[PACKAGE]
https://github.com/advisories/GHSA-8pwp-phcg-h36g[ADVISORY]