CVE-2024-10830

Path Traversal in eosphoros-ai/db-gpt

State: Published
Severity: 8.2 High
Published: Mar 20, 2025
Updated: Mar 20, 2025
Reserved: Nov 4, 2024

Description

A Path Traversal vulnerability exists in the eosphoros-ai/db-gpt version 0.6.0 at the API endpoint `/v1/resource/file/delete`. This vulnerability allows an attacker to delete any file on the server by manipulating the `file_key` parameter. The `file_key` parameter is not properly sanitized, enabling an attacker to specify arbitrary file paths. If the specified file exists, the application will delete it.

Scores

CVSS	Score	Vector	Source
3.0	8.2 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H	@huntr_ai

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
eosphoros-ai/db-gpteosphoros-ai	latest and earlierAffected

References

https://huntr.com/bounties/26adf08a-9262-4d5a-a2ee-ce12ed919620

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.