CVE-2024-10902: Arbitrary File Upload with Path Traversal in eosphoros-ai/db-gpt
In eosphoros-ai/db-gpt version v0.6.0, the web API POST /v1/personal/agent/upload is vulnerable to Arbitrary File Upload with Path Traversal. This vulnerability allows unauthorized attackers to upload arbitrary files to the victim's file system at any location. The impact of this vulnerability includes the potential for remote code execution (RCE) by writing malicious files, such as a malicious init.py in the Python's /site-packages/ directory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10902?
CVE-2024-10902 is rated as a critical severity vulnerability due to its potential for arbitrary file uploads.
How do I fix CVE-2024-10902?
To mitigate CVE-2024-10902, implement proper input validation and restrict file upload functionality to only allow safe file types.
Who is affected by CVE-2024-10902?
CVE-2024-10902 affects users of eosphoros-ai/db-gpt version v0.6.0 and prior.
What type of vulnerability is CVE-2024-10902?
CVE-2024-10902 is classified as an Arbitrary File Upload vulnerability with Path Traversal.
What are the potential impacts of CVE-2024-10902?
CVE-2024-10902 could allow attackers to upload malicious files to arbitrary locations in the victim's file system.