{"id":"CVE-2024-10901","kind":"vulnerability","aliases":["CVE-2024-10901","GHSA-7gj6-22m4-qfhx"],"related":[],"title":"DB-GPT Arbitrary File Write vulnerability","description":"In eosphoros-ai/db-gpt version v0.6.3 and earlier, the web API `POST /api/v1/editor/chart/run` allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write, enabling them to write arbitrary files to the victim's file system. This can potentially lead to Remote Code Execution (RCE) by writing malicious files such as `__init__.py` in the Python's `/site-packages/` directory.","summary":"DB-GPT, an AI framework for database chat, exposes a web API endpoint that runs arbitrary SQL without access control. An attacker can use it to write files anywhere the service can write, which can lead to remote code execution by planting a module such as __init__.py in the Python site-packages directory.","severity":"critical","cvss":9.8,"epss":0.01095,"exploited":false,"exploited_at":null,"products":[{"name":"dbgpt","fixed":[],"affected":"<= 0.6.3","ecosystem":"pypi"},{"name":"dbgpt db-gpt","fixed":[],"affected":"= 0.6.0","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["ai-tooling","cwe-434","cwe-89","dbgpt","python","self-hosted"],"not_affected_if":["auth-required","managed-hosting"],"how_to_check":"- Run `pip show dbgpt` and check whether the installed version is `0.6.3` or earlier.\n- Check whether the web API is reachable from untrusted networks and whether `POST /api/v1/editor/chart/run` responds on your deployment.","fix":"- Upgrade the `dbgpt` package to a version later than `0.6.3`; the fixed version is unknown from the sources.\n- Until patched, block external access to `/api/v1/editor/chart/run` and restrict the service to trusted networks.","status":"open","published_at":"2025-03-20T10:15:20+00:00","first_seen_at":"2026-10-27T16:30:45+00:00","triaged_at":"2026-10-27T16:31:54+00:00","updated_at":"2026-10-27T16:33:07+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-27T16:31:54Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the `dbgpt` package to a version later than `0.6.3`; the fixed version is unknown from the sources.\n- Until patched, block external access to `/api/v1/editor/chart/run` and restrict the service to trusted networks.","reach":"internet","title":"DB-GPT: unauthenticated SQL endpoint lets attackers write files to disk","impact":"high","summary":"DB-GPT, an AI framework for database chat, exposes a web API endpoint that runs arbitrary SQL without access control. An attacker can use it to write files anywhere the service can write, which can lead to remote code execution by planting a module such as __init__.py in the Python site-packages directory.","category":"ai-tooling","nicknames":[],"who_cares":["python","self-hosted","dbgpt"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker writes arbitrary files, potentially achieving code execution on the server.","analyst_note":"Confirm the fixed version and whether the web API is enabled by default; check https://github.com/advisories/GHSA-7gj6-22m4-qfhx.","how_to_check":"- Run `pip show dbgpt` and check whether the installed version is `0.6.3` or earlier.\n- Check whether the web API is reachable from untrusted networks and whether `POST /api/v1/editor/chart/run` responds on your deployment.","needs_analyst":true,"not_affected_if":["auth-required","managed-hosting"],"who_is_affected":"Teams running DB-GPT version 0.6.3 or earlier with its web API reachable by users or networks they do not fully trust. The endpoint accepts requests without authentication, so any deployment exposed beyond a trusted network is at risk. Deployments that are not running the web API or keep it behind access controls are less exposed; the sources do not say more.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000677,"input_tokens":3431,"output_tokens":667,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-10901':10A,18A '-2024':9A,17A '-434':28B '-89':30B '/api/v1/editor/chart/run':105C '/db-gpt':96C '/site-packages':161C '22m4':14A '7gj6':13A 'access':55B,114C 'ai':25B,40B,95C 'ai-tool':24B 'allow':106C 'anywher':65B 'api':48B,103C 'arbitrari':4A,52B,109C,125C,132C 'attack':58B,122C 'chat':44B 'code':75B,146C 'control':56B,115C 'cve':8A,16A 'cwe':27B,29B 'databas':43B 'db':2A,22A,37B 'db-gpt':1A,21A,36B 'dbgpt':19A,20A,31B 'directori':91B,162C 'earlier':100C 'enabl':128C 'endpoint':49B 'eosphoro':94C 'eosphoros-ai':93C 'execut':76B,107C,147C 'exploit':120C 'expos':45B 'file':5A,64B,126C,133C,138C,152C 'framework':41B 'ghsa':12A 'ghsa-7gj6-22m4-qfhx':11A 'gpt':3A,23A,38B 'host':35B 'init':83B,155C 'lead':72B,143C 'malici':151C 'modul':80B 'packag':90B 'perform':124C 'plant':78B 'post':104C 'potenti':142C 'py':84B,156C 'python':32B,87B,159C 'qfhx':15A 'queri':111C 'rce':148C 'remot':74B,145C 'run':51B 'self':34B 'self-host':33B 'servic':67B 'site':89B 'site-packag':88B 'sql':53B,110C 'system':139C 'tool':26B 'use':60B 'v0.6.3':98C 'version':97C 'victim':136C 'vulner':7A,117C 'web':47B,102C 'without':54B,112C 'write':6A,63B,69B,127C,131C,150C","nicknames":[],"mitigations":[],"who_affected":"Teams running DB-GPT version 0.6.3 or earlier with its web API reachable by users or networks they do not fully trust. The endpoint accepts requests without authentication, so any deployment exposed beyond a trusted network is at risk. Deployments that are not running the web API or keep it behind access controls are less exposed; the sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2025-03-20T10:15:20+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-7gj6-22m4-qfhx","url":"https://github.com/advisories/GHSA-7gj6-22m4-qfhx","severity":"critical","published_at":"2025-03-20T12:32:40+00:00","modified_at":"2026-10-27T16:26:00+00:00","first_seen_at":"2026-10-27T16:30:45+00:00","fetched_at":"2026-10-27T16:30:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-10901","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10901","severity":null,"published_at":"2025-03-20T10:15:20+00:00","modified_at":"2026-06-17T06:56:39+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","fetched_at":"2026-10-27T16:33:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}