CVE-2024-10902: Arbitrary File Upload with Path Traversal in eosphoros-ai/db-gpt
First published: Thu Mar 20 2025(Updated: )
In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /v1/personal/agent/upload` is vulnerable to Arbitrary File Upload with Path Traversal. This vulnerability allows unauthorized attackers to upload arbitrary files to the victim's file system at any location. The impact of this vulnerability includes the potential for remote code execution (RCE) by writing malicious files, such as a malicious `__init__.py` in the Python's `/site-packages/` directory.
Credit: security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| eosphoros-ai db-gpt | ||
| pip/dbgpt | <=0.6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-10902?
CVE-2024-10902 is rated as a critical severity vulnerability due to its potential for arbitrary file uploads.
How do I fix CVE-2024-10902?
To mitigate CVE-2024-10902, implement proper input validation and restrict file upload functionality to only allow safe file types.
Who is affected by CVE-2024-10902?
CVE-2024-10902 affects users of eosphoros-ai/db-gpt version v0.6.0 and prior.
What type of vulnerability is CVE-2024-10902?
CVE-2024-10902 is classified as an Arbitrary File Upload vulnerability with Path Traversal.
What are the potential impacts of CVE-2024-10902?
CVE-2024-10902 could allow attackers to upload malicious files to arbitrary locations in the victim's file system.
- agent/title
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- collector/nvd-api
- source/NVD
- agent/author
- agent/severity
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-3xq5-x4fj-rff7
- alias/CVE-2024-10902
- collector/nvd-cve
- agent/last-modified-date
- agent/source
- agent/references
- agent/softwarecombine
- agent/tags
- agent/event
- collector/mitre-cve
- source/MITRE
- collector/github-advisory
- vendor/eosphoros-ai
- canonical/eosphoros-ai db-gpt
- package-manager/pip