CVE-2024-10831: Arbitrary File Write through Absolute Path Traversal in eosphoros-ai/db-gpt
First published: Thu Mar 20 2025(Updated: )
In eosphoros-ai/db-gpt version 0.6.0, the endpoint for uploading files is vulnerable to absolute path traversal. This vulnerability allows an attacker to upload arbitrary files to arbitrary locations on the target server. The issue arises because the `file_key` and `doc_file.filename` parameters are user-controllable, enabling the construction of paths outside the intended directory. This can lead to overwriting essential system files, such as SSH keys, for further exploitation.
Credit: security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| eosphoros-ai db-gpt | ||
| pip/dbgpt | <=0.6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-10831?
CVE-2024-10831 is classified as a high severity vulnerability due to its potential for unauthorized file uploads.
How do I fix CVE-2024-10831?
To mitigate CVE-2024-10831, you should update to version 0.6.1 or later of eosphoros-ai/db-gpt, which addresses the path traversal issue.
What types of attacks can CVE-2024-10831 facilitate?
CVE-2024-10831 can facilitate attacks that allow an attacker to upload arbitrary files to arbitrary locations on the server.
Which versions of eosphoros-ai/db-gpt are affected by CVE-2024-10831?
CVE-2024-10831 affects all versions of eosphoros-ai/db-gpt up to and including version 0.6.0.
Is CVE-2024-10831 related to file upload vulnerabilities?
Yes, CVE-2024-10831 is specifically a file upload vulnerability that involves absolute path traversal.
- agent/title
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- collector/nvd-api
- source/NVD
- agent/author
- agent/severity
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-hhw5-29f6-hf4x
- alias/CVE-2024-10831
- collector/nvd-cve
- agent/last-modified-date
- agent/source
- agent/references
- agent/softwarecombine
- agent/tags
- agent/event
- collector/mitre-cve
- source/MITRE
- collector/github-advisory
- vendor/eosphoros-ai
- canonical/eosphoros-ai db-gpt
- package-manager/pip