CVE-2024-10831Critical· 9.1▾ MidnightDB-GPT Absolute Path Traversal vulnerability
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.8%
In eosphoros-ai/db-gpt version 0.6.0, the endpoint for uploading files is vulnerable to absolute path traversal. This vulnerability allows an attacker to upload arbitrary files to arbitrary locations on the target server. The issue arises because the file_key and doc_file.filename parameters are user-controllable, enabling the construction of paths outside the intended directory. This can lead to overwriting essential system files, such as SSH keys, for further exploitation.
dbgpt <= 0.6.0Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-10833Critical· 9.1DB-GPT Absolute Path Traversal in knowledge/{space_name}/document/upload
CVE-2024-10902Critical· 9.1DB-GPT vulnerable to Arbitrary File Upload with Path Traversal
CVE-2024-10901Critical· 9.1DB-GPT Arbitrary File Write vulnerability
CVE-2024-10835Critical· 9.1DB-GPT is vulnerable to SQL Injection attacks from unauthenticated users
CVE-2024-10830High· 8.2DB-GPT Path Traversal vulnerability
CVE-2024-10829High· 7.5DB-GPT Uncontrolled Resource Consumption vulnerability