CyberRota Analysis
AI-GeneratedDB-GPT versions 0.7.5 and 0.8.0 are vulnerable to a directory traversal flaw in the python_file_upload function, allowing remote attackers to write files outside the designated workspace. This could lead to unauthorized access or manipulation of sensitive files on the server. Organizations using these specific versions should prioritize patching this vulnerability to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py:42). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary.