CVE-2024-10830: Path Traversal in eosphoros-ai/db-gpt
A Path Traversal vulnerability exists in the eosphoros-ai/db-gpt version 0.6.0 at the API endpoint /v1/resource/file/delete. This vulnerability allows an attacker to delete any file on the server by manipulating the filekey parameter. The filekey parameter is not properly sanitized, enabling an attacker to specify arbitrary file paths. If the specified file exists, the application will delete it.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10830?
The severity of CVE-2024-10830 is high due to its ability to allow attackers to delete arbitrary files on the server.
How do I fix CVE-2024-10830?
To fix CVE-2024-10830, validate and sanitize the `file_key` parameter thoroughly to prevent path traversal exploits.
What software is affected by CVE-2024-10830?
CVE-2024-10830 affects eosphoros-ai/db-gpt version 0.6.0.
What is the impact of CVE-2024-10830?
The impact of CVE-2024-10830 allows unauthorized deletion of files, which can lead to data loss and system instability.
How can an attacker exploit CVE-2024-10830?
An attacker can exploit CVE-2024-10830 by manipulating the `file_key` parameter in the API endpoint `/v1/resource/file/delete` to delete files.