Read the docs
TI-2024-10043 Aliases CVE-2024-10834GHSA-7h46-xxgg-f9q8

Arbitrary File Write in eosphoros-ai/db-gpt

Priority HIGH 78CWE-73Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA.

Summary

eosphoros-ai/db-gpt version 0.6.0 contains a vulnerability in the RAG-knowledge endpoint that allows for arbitrary file write. The issue arises from the ability to pass an absolute path to a call to `os.path.join`, enabling an attacker to write files to arbitrary locations on the target server. This vulnerability can be exploited by setting the `doc_file.filename` to an absolute path, which can lead to overwriting system files or creating new SSH-key entries.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00637 50th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
eosphoros-aieosphoros-ai/db-gptup to latest—No fix listedCNA
  • eosphoros-ai/db-gpt Vendoreosphoros-ai Affected up to latest Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dbgpt:db-gpt:0.6.0:*:*:*:*:*:*:*0.6.0Vulnerableeosphoros-ai
  • cpe:2.3:a:dbgpt:db-gpt:0.6.0:*:*:*:*:*:*:* Versions 0.6.0 Vulnerable ·eosphoros-ai

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-10834
  2. 2026-10-03 Alias added: GHSA-7h46-xxgg-f9q8
  3. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Exploit 1

  • TI-2024-10106 Arbitrary File Upload with Path Traversal in eosphoros-ai/db-gpt CVSS 3.1CRITICAL 9.8
  • TI-2024-10105 Arbitrary File Write via DuckDB SQL Injection in eosphoros-ai/db-gpt CVSS 3.1CRITICAL 9.8
  • TI-2024-10044 Arbitrary File Write via SQL Injection in eosphoros-ai/db-gpt CVSS 3.1CRITICAL 9.8
  • TI-2024-10042 Arbitrary File Write in eosphoros-ai/db-gpt CVSS 3.0CRITICAL 9.1
  • TI-2024-10040 Arbitrary File Write through Absolute Path Traversal in eosphoros-ai/db-gpt CVSS 3.0CRITICAL 9.1
  • TI-2025-00369 Arbitrary File Deletion in eosphoros-ai/DB-GPT CVSS 3.0HIGH 8.2
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences