Live › vulnerability › CVE-2024-10902
Go to dashboardDB-GPT v0.6.0 exposes POST /v1/personal/agent/upload, which lets an attacker write files to any location on the server through path traversal. Writing a malicious __init__.py into the Python site-packages directory can lead to remote code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:25 UTC, 0h before NVD. All times on this page are UTC.
DB-GPT deployments at v0.6.0 or earlier that expose the web API reachable by the upload route. The sources do not say whether authentication is required for the upload endpoint, so treat any reachable instance as exposed. Teams not running DB-GPT can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| dbgpt | pypi | <= 0.6.0 | – |
| dbgpt db-gpt | vendor | = 0.6.0 | – |
pip show dbgpt and see whether it is 0.6.0 or earlier./v1/personal/agent/upload in the deployed DB-GPT server.dbgpt package to a version later than 0.6.0; the fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In eosphoros-ai/db-gpt version v0.6.0, the web API POST /v1/personal/agent/upload is vulnerable to Arbitrary File Upload with Path Traversal. This vulnerability allows unauthorized attackers to upload arbitrary files to the victim's file system at any location. The impact of this vulnerability includes the potential for remote code execution (RCE) by writing malicious files, such as a malicious __init__.py in the Python's /site-packages/ directory.
This page as .md · .json · in your agent: get_signal("CVE-2024-10902")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.