Critical severity9.1NVD Advisory· Published Mar 20, 2025· Updated Jun 17, 2026
CVE-2024-10833
CVE-2024-10833
Description
eosphoros-ai/db-gpt version 0.6.0 is vulnerable to an arbitrary file write through the knowledge API. The endpoint for uploading files as 'knowledge' is susceptible to absolute path traversal, allowing attackers to write files to arbitrary locations on the target server. This vulnerability arises because the 'doc_file.filename' parameter is user-controllable, enabling the construction of absolute paths.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
dbgptPyPI | < 0.6.2 | 0.6.2 |
Affected products
3- cpe:2.3:a:dbgpt:db-gpt:0.6.0:*:*:*:*:*:*:*
- eosphoros-ai/eosphoros-ai/db-gptv5Range: unspecified
Patches
Vulnerability mechanics
References
4- huntr.com/bounties/dc58e981-e325-4c11-b4e1-1095890fd15anvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-j9g7-mqhh-9hxfghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-10833ghsaADVISORY
- github.com/eosphoros-ai/DB-GPT/commit/780ce803e325b87f4ddfbe5824451e379aeee56cghsaWEB
News mentions
0No linked articles in our index yet.