Db Gpt CVE-2025-6772

We need to produce a JSON with all required fields, synthesizing data from all sources.

We are told: "A vulnerability was found in eosphoros-ai db-gpt up to 0.7.2. It has been classified as critical. Affected is the function import_flow of the file /api/v2/serve/awel/flow/import. The manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used." CVSS: 5.5, CVSS vector: 4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P ... So it's a critical classification from vuldb, but CVSS 5.5 is medium. Actually CVSS 4.0 base score? 5.5 is medium. The EPSS: 0.43% (62 percentile) moderate. POC is publicly available, no KEV. CPE: cpe:2.3:a:dbgpt:db-gpt:*:*:*:*:*:*:*:*. Tags: Path Traversal. References: NVD link to github issue, vuldb entries. Affected versions from EUVD: db-gpt 0.7.1, 0.7.0, 0.7.2. (up to 0.7.2).

We need to produce: product_name (1-3 words): "db-gpt" maybe? It's eosphoros-ai DB-GPT. I'd say "DB-GPT". Product name: "db-gpt" according to CPE. We'll output "DB-GPT". Summary: not copying description, write original synthesis: e.g., "Path traversal in DB-GPT up to 0.7.2 allows remote unauthenticated attackers to upload arbitrary files via the import_flow endpoint." The description: manipulation of argument File leads to path traversal. The import_flow endpoint likely expects a file upload and then path traversal on the filename? So file upload traversal. "Allows remote attackers to write files to arbitrary locations on the server, potentially leading to code execution." But need to ground in data. CVSS vector says VC:L/VI:L/VA:L so confidentiality, integrity, availability all low. So low impact. But critical classification might be hyperbole. We'll synthesize: "Path traversal in the AWEL flow import functionality allows remote attackers to overwrite or create files outside the intended directory, potentially leading to low-level system compromise."