CVE-2026-4504: eosphoros-ai db-gpt Incomplete Fix editor sql injection
A flaw has been found in eosphoros-ai db-gpt up to 0.7.5. This vulnerability affects unknown code of the file /api/v1/editor/ of the component Incomplete Fix. This manipulation causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4504?
CVE-2026-4504 is classified as a high severity vulnerability due to its potential for remote SQL injection.
How do I fix CVE-2026-4504?
To fix CVE-2026-4504, it is recommended to upgrade eosphoros-ai db-gpt to version 0.7.6 or later.
What is affected by CVE-2026-4504?
CVE-2026-4504 affects eosphoros-ai db-gpt versions up to 0.7.5, specifically targeting the /api/v1/editor/ component.
Can CVE-2026-4504 be exploited remotely?
Yes, CVE-2026-4504 allows for remote exploitation through SQL injection.
What are the potential impacts of CVE-2026-4504?
The impacts of CVE-2026-4504 include unauthorized access to the database and potential data manipulation.