---
id: CVE-2024-10833
aliases:
  - GHSA-j9g7-mqhh-9hxf
  - PYSEC-2026-324
title: 'DB-GPT Absolute Path Traversal in knowledge/{space_name}/document/upload'
summary: 'DB-GPT Absolute Path Traversal in knowledge/{space_name}/document/upload'
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'
vendor: dbgpt
product: dbgpt
ecosystem: pip
affected:
  - dbgpt < 0.6.2
patched:
  - dbgpt 0.6.2
published: '2025-03-20'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T16:30:07.135197616Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-j9g7-mqhh-9hxf'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-10833'
  - url: >-
      https://github.com/eosphoros-ai/DB-GPT/commit/780ce803e325b87f4ddfbe5824451e379aeee56c
  - url: 'https://github.com/eosphoros-ai/DB-GPT'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/dbgpt/PYSEC-2026-324.yaml
  - url: 'https://huntr.com/bounties/dc58e981-e325-4c11-b4e1-1095890fd15a'
  - url: 'https://pypi.org/project/dbgpt'
  - url: 'https://github.com/advisories/GHSA-j9g7-mqhh-9hxf'
tags:
  - osv
  - pip
  - ghsa
epss: 0.00839
epssPercentile: 0.57625
cwe:
  - CWE-22
  - CWE-36
ingestedAt: '2026-10-27T16:32:34.354Z'
---

## Overview

eosphoros-ai/db-gpt version 0.6.0 is vulnerable to an arbitrary file write through the knowledge API. The endpoint for uploading files as 'knowledge' is susceptible to absolute path traversal, allowing attackers to write files to arbitrary locations on the target server. This vulnerability arises because the 'doc_file.filename' parameter is user-controllable, enabling the construction of absolute paths.

## Affected packages

- `dbgpt < 0.6.2`

## Remediation

Upgrade to a patched release:

- `dbgpt 0.6.2`