DB-GPT CVE-2025-6772

The /api/v2/serve/awel/flow/import endpoint must be reachable over the network. Based on the CVSS 4.0 vector (PR:N/UI:N), no authentication credential is required to invoke this endpoint - the AWEL flow import API appears to be unauthenticated by default in affected versions. The AWEL flow import feature must be present, which is standard in DB-GPT 0.7.x. Exploitation impact is bounded by the OS-level file permissions of the DB-GPT process: a process running as a non-root user confined to its application directory, or inside a container with a read-only filesystem, will face a reduced blast radius. Internet-exposed instances without authentication enforcement in front of the API are at highest risk.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/E:P) establishes this as unauthenticated, low-complexity, remotely exploitable with a confirmed public proof-of-concept, yet the scored value of 5.5 reflects constrained impact (VC:L/VI:L/VA:L) rather than full system compromise. The EPSS of 0.43% at the 62nd percentile is modest in absolute terms but elevated relative to the broader CVE population, consistent with niche software that attracts researcher attention after POC publication. The no-authentication requirement combined with a live exploit means that even a mid-sized municipal IT team in radom should treat this as urgent if they expose DB-GPT to untrusted networks. The primary escalation concern is that path traversal write access - if the process has sufficient filesystem privileges - can be leveraged to overwrite template files, configuration files, or Python modules loaded by the application, potentially escalating to remote code execution beyond the L/L/L impact the CVSS reflects. Deployments running DB-GPT in a locked-down container or with a read-only application directory will see reduced real-world impact.

An unauthenticated attacker sends a crafted multipart HTTP POST request to /api/v2/serve/awel/flow/import on an internet-exposed DB-GPT instance, embedding a File parameter containing directory traversal sequences (e.g., ../../.env or ../../config/db.yaml) to retrieve sensitive files such as database credentials or API keys. With write-capable traversal, the attacker may overwrite a Python module or configuration file loaded at runtime, converting the path traversal into persistent code execution. The public POC lowers the technical barrier to near-zero for this attack.