CVE-2026-4505: eosphoros-ai DB-GPT FastAPI Endpoint controller.py module_plugin.refresh_plugins unrestricted upload
A vulnerability has been found in eosphoros-ai DB-GPT up to 0.7.5. This issue affects the function moduleplugin.refreshplugins of the file packages/dbgpt-serve/src/dbgptserve/agent/hub/controller.py of the component FastAPI Endpoint. Such manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4505?
CVE-2026-4505 is classified as a critical vulnerability due to its potential for unrestricted file uploads.
How do I fix CVE-2026-4505?
To mitigate CVE-2026-4505, upgrade eosphoros-ai DB-GPT to version 0.7.6 or later where the vulnerability has been addressed.
Which versions of eosphoros-ai DB-GPT are affected by CVE-2026-4505?
CVE-2026-4505 affects eosphoros-ai DB-GPT versions up to and including 0.7.5.
What is the nature of the vulnerability in CVE-2026-4505?
The vulnerability in CVE-2026-4505 allows for unrestricted file uploads through the module_plugin.refresh_plugins function.
Can CVE-2026-4505 be exploited remotely?
Yes, CVE-2026-4505 can be exploited remotely by an attacker with access to the affected FastAPI endpoint.