GHSA-8pwp-phcg-h36g

Suggest an improvement
Source
https://github.com/advisories/GHSA-8pwp-phcg-h36g
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-8pwp-phcg-h36g/GHSA-8pwp-phcg-h36g.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-8pwp-phcg-h36g
Aliases
Published
2025-03-20T12:32:40Z
Modified
2026-07-07T17:57:24Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H CVSS Calculator
Summary
DB-GPT Path Traversal vulnerability
Details

A Path Traversal vulnerability exists in the eosphoros-ai/db-gpt version 0.6.0 at the API endpoint /v1/resource/file/delete. This vulnerability allows an attacker to delete any file on the server by manipulating the file_key parameter. The file_key parameter is not properly sanitized, enabling an attacker to specify arbitrary file paths. If the specified file exists, the application will delete it.

Database specific 
{
    "cwe_ids": [
        "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-21T16:25:39Z",
    "nvd_published_at": "2025-03-20T10:15:20Z",
    "severity": "HIGH"
}
References

Affected packages

PyPI / dbgpt

Package

Name
dbgpt
View open source insights on deps.dev
Purl
pkg:pypi/dbgpt

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
0.6.0

Affected versions

0.*
0.4.7
0.5.0
0.5.1rc0
0.5.1
0.5.2rc0
0.5.2
0.5.3rc0
0.5.3
0.5.4rc0
0.5.4
0.5.5rc0
0.5.5
0.5.6rc0
0.5.6
0.5.7rc0
0.5.7
0.5.8
0.5.9rc0
0.5.9
0.5.10

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-8pwp-phcg-h36g/GHSA-8pwp-phcg-h36g.json"