~ / search / GHSA-8pwp-phcg-h36g

GHSA-8pwp-phcg-h36g

DB-GPT Path Traversal vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2024-10830

Packages

EcosystemPackageAffectedFixed in
PyPI dbgpt <= 0.6.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A Path Traversal vulnerability exists in the eosphoros-ai/db-gpt version 0.6.0 at the API endpoint `/v1/resource/file/delete`. This vulnerability allows an attacker to delete any file on the server by manipulating the `file_key` parameter. The `file_key` parameter is not properly sanitized, enabling an attacker to specify arbitrary file paths. If the specified file exists, the application will delete it.

References

External links from the advisory. They lead to third-party sites.