{"id":"CVE-2024-10902","kind":"vulnerability","aliases":["CVE-2024-10902","GHSA-3xq5-x4fj-rff7"],"related":[],"title":"DB-GPT vulnerable to Arbitrary File Upload with Path Traversal","description":"In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /v1/personal/agent/upload` is vulnerable to Arbitrary File Upload with Path Traversal. This vulnerability allows unauthorized attackers to upload arbitrary files to the victim's file system at any location. The impact of this vulnerability includes the potential for remote code execution (RCE) by writing malicious files, such as a malicious `__init__.py` in the Python's `/site-packages/` directory.","summary":"DB-GPT v0.6.0 exposes POST /v1/personal/agent/upload, which lets an attacker write files to any location on the server through path traversal. Writing a malicious __init__.py into the Python site-packages directory can lead to remote code execution.","severity":"critical","cvss":9.8,"epss":0.01313,"exploited":false,"exploited_at":null,"products":[{"name":"dbgpt","fixed":[],"affected":"<= 0.6.0","ecosystem":"pypi"},{"name":"dbgpt db-gpt","fixed":[],"affected":"= 0.6.0","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["ai-apps","ai-tooling","cwe-22","cwe-73","dbgpt","pypi","python","self-hosted"],"not_affected_if":["dbgpt-above-0.6.0"],"how_to_check":"- Check the installed version with `pip show dbgpt` and see whether it is `0.6.0` or earlier.\n- Look for the route `/v1/personal/agent/upload` in the deployed DB-GPT server.","fix":"- Upgrade the `dbgpt` package to a version later than `0.6.0`; the fixed version is unknown from the sources.\n- Until patched, block external access to the DB-GPT web API.","status":"open","published_at":"2025-03-20T10:15:21+00:00","first_seen_at":"2026-10-27T16:25:43+00:00","triaged_at":"2026-10-27T16:27:45+00:00","updated_at":"2026-10-27T16:33:07+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-27T16:27:45Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the `dbgpt` package to a version later than `0.6.0`; the fixed version is unknown from the sources.\n- Until patched, block external access to the DB-GPT web API.","reach":"internet","title":"DB-GPT: unauthenticated file upload with path traversal enables code execution","impact":"high","summary":"DB-GPT v0.6.0 exposes POST /v1/personal/agent/upload, which lets an attacker write files to any location on the server through path traversal. Writing a malicious __init__.py into the Python site-packages directory can lead to remote code execution.","category":"ai-tooling","nicknames":[],"who_cares":["python","pypi","dbgpt","self-hosted","ai-apps"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker writes arbitrary files and may achieve code execution on the server","analyst_note":"Confirm the fixed version and whether the upload route requires authentication, using the GHSA-3xq5-x4fj-rff7 advisory page.","how_to_check":"- Check the installed version with `pip show dbgpt` and see whether it is `0.6.0` or earlier.\n- Look for the route `/v1/personal/agent/upload` in the deployed DB-GPT server.","needs_analyst":true,"not_affected_if":["dbgpt-above-0.6.0"],"who_is_affected":"DB-GPT deployments at v0.6.0 or earlier that expose the web API reachable by the upload route. The sources do not say whether authentication is required for the upload endpoint, so treat any reachable instance as exposed. Teams not running DB-GPT can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000647,"input_tokens":3437,"output_tokens":606,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-10902':14A,22A '-2024':13A,21A '-22':35B '-73':37B '/db-gpt':88C '/site-packages':150C '/v1/personal/agent/upload':50B,95C '3xq5':17A 'ai':29B,32B,87C 'ai-app':28B 'ai-tool':31B 'allow':107C 'api':93C 'app':30B 'arbitrari':6A,99C,112C 'attack':54B,109C 'code':82B,133C 'cve':12A,20A 'cwe':34B,36B 'db':2A,26A,45B 'db-gpt':1A,25A,44B 'dbgpt':23A,24A,38B 'directori':77B,151C 'eosphoro':86C 'eosphoros-ai':85C 'execut':83B,134C 'expos':48B 'file':7A,56B,100C,113C,118C,139C 'ghsa':16A 'ghsa-3xq5-x4fj-rff7':15A 'gpt':3A,27A,46B 'host':43B 'impact':124C 'includ':128C 'init':69B,144C 'lead':79B 'let':52B 'locat':59B,122C 'malici':68B,138C,143C 'packag':76B 'path':10A,64B,103C 'post':49B,94C 'potenti':130C 'py':70B,145C 'pypi':39B 'python':40B,73B,148C 'rce':135C 'remot':81B,132C 'rff7':19A 'self':42B 'self-host':41B 'server':62B 'site':75B 'site-packag':74B 'system':119C 'tool':33B 'travers':11A,65B,104C 'unauthor':108C 'upload':8A,101C,111C 'v0.6.0':47B,90C 'version':89C 'victim':116C 'vulner':4A,97C,106C,127C 'web':92C 'write':55B,66B,137C 'x4fj':18A","nicknames":[],"mitigations":[],"who_affected":"DB-GPT deployments at v0.6.0 or earlier that expose the web API reachable by the upload route. The sources do not say whether authentication is required for the upload endpoint, so treat any reachable instance as exposed. Teams not running DB-GPT can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2025-03-20T10:15:21+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-3xq5-x4fj-rff7","url":"https://github.com/advisories/GHSA-3xq5-x4fj-rff7","severity":"critical","published_at":"2025-03-20T12:32:40+00:00","modified_at":"2026-10-27T16:21:54+00:00","first_seen_at":"2026-10-27T16:25:43+00:00","fetched_at":"2026-10-27T16:25:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-10902","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10902","severity":null,"published_at":"2025-03-20T10:15:21+00:00","modified_at":"2026-06-17T06:56:39+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","fetched_at":"2026-10-27T16:33:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}