CVE-2025-0452: Arbitrary File Deletion in eosphoros-ai/DB-GPT

Published Mar 20, 2025

Updated

eosphoros-ai/DB-GPT version latest is vulnerable to arbitrary file deletion on Windows systems via the '/v1/agent/hub/update' endpoint. The application fails to properly filter the '\' character, which is commonly used as a separator in Windows paths. This vulnerability allows attackers to delete any files on the host system by manipulating the 'pluginreponame' variable.

Affected Software

2 affected components

eosphoros-ai db-gpt

dbgpt db-gpt=0.6.1

Event History

Mar 20, 2025

CVE Published

via MITRE·10:08 AM

Data Sourced

via MITRE·10:08 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-0452?

CVE-2025-0452 is considered a high severity vulnerability due to the potential for arbitrary file deletion on Windows systems.

How do I fix CVE-2025-0452?

To fix CVE-2025-0452, ensure that your application properly filters out the '\' character to prevent path traversal issues.

Who is affected by CVE-2025-0452?

CVE-2025-0452 affects users of the latest version of the eosphoros-ai/DB-GPT application on Windows systems.

What is the exploitation impact of CVE-2025-0452?

The exploitation of CVE-2025-0452 could lead to unauthorized deletion of important files on affected systems.

Where can I find more information on CVE-2025-0452?

More information about CVE-2025-0452 can be found in security advisories and vulnerability databases.