PYSEC-2026-1291

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/dbgpt/PYSEC-2026-1291.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2026-1291
Aliases
Published
2026-07-07T14:34:51Z
Modified
2026-07-07T17:47:34Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H CVSS Calculator
Summary
DB-GPT Path Traversal vulnerability
Details

A Path Traversal vulnerability exists in the eosphoros-ai/db-gpt version 0.6.0 at the API endpoint /v1/resource/file/delete. This vulnerability allows an attacker to delete any file on the server by manipulating the file_key parameter. The file_key parameter is not properly sanitized, enabling an attacker to specify arbitrary file paths. If the specified file exists, the application will delete it.

References

Affected packages

PyPI / dbgpt

Package

Name
dbgpt
View open source insights on deps.dev
Purl
pkg:pypi/dbgpt

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
0.6.0

Affected versions

0.*
0.4.7
0.5.0
0.5.1rc0
0.5.1
0.5.2rc0
0.5.2
0.5.3rc0
0.5.3
0.5.4rc0
0.5.4
0.5.5rc0
0.5.5
0.5.6rc0
0.5.6
0.5.7rc0
0.5.7
0.5.8
0.5.9rc0
0.5.9
0.5.10

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/dbgpt/PYSEC-2026-1291.yaml"