Db Gpt
Monthly
DB-GPT through 0.8.2 ships a default docker-compose.yml that hardcodes the MySQL root password and publishes port 3306 on every host interface, so any instance deployed with the stock configuration exposes a root@% database account with publicly known credentials. An unauthenticated remote attacker who can reach port 3306, or who has a foothold on the shared 'dbgptnet' Docker bridge network, can log in with that static password and inherit FILE and SUPER privileges - full read/write access to all DB-GPT data plus the ability to read or write files on the database host. Publicly available exploit code exists (referenced by VulnCheck and Lasso Security); the issue is not in CISA KEV, but any deployment left in its default state is directly exploitable, and operators who rotated the root password, bound 3306 to localhost, or firewalled the host are materially less exposed.
Unauthenticated remote code execution in DB-GPT through 0.8.2 allows remote attackers to reach the /api/v1/chat/react-agent endpoint, where a mock get_user_from_headers function grants every caller the admin role. Crafted prompts can cause the ReAct agent's unsandboxed code_interpreter and shell_interpreter tools to execute arbitrary Python or bash as root in the webserver container, potentially reaching the bundled database with default credentials. Publicly available exploit code exists; the provided data does not confirm active exploitation, and the assessed CVSS 3.1 severity is 9.3 with network access, no privileges, and no user interaction required when the endpoint and interpreter tools are deployed and reachable.
Path traversal in DB-GPT 0.7.5 and 0.8.0 lets remote attackers write arbitrary files outside the intended upload workspace through the OpenAPI python_file_upload endpoint at packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py:42. The affected service is the DB-GPT web API and the vector is rated critical (CVSS 9.1, AV:N/AC:L/PR:N/UI:N), so exploitation hinges on network reachability of the instance rather than on any attacker-held credentials - DB-GPT ships its API without enforced authentication by default, which is why the score is PR:N. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis; EPSS is low at 0.47% (38th percentile), so this is a genuine but not yet mass-exploited issue. Note a scoring divergence: NVD rates confidentiality and integrity high with no availability impact, while our independent assessment rates integrity and availability high and confidentiality none.
Unauthenticated arbitrary file write in DB-GPT 0.8.0 lets remote attackers achieve remote code execution through the skill_upload endpoint, which builds an upload path by joining the user-controlled multipart filename to the upload directory without canonicalisation or containment checks. Because the route's only auth dependency (get_user_from_headers) returns an admin-role request even when no credentials are supplied, an attacker with no account can write a .py file such as ../../../tmp/x or /tmp/x anywhere the server process can write, then plant or overwrite a Python module that executes when next imported. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the flaw is trivially exploitable and fixed in v0.8.1.
An unrestricted file upload vulnerability exists in eosphoros-ai DB-GPT versions up to 0.7.5 within the module_plugin.refresh_plugins function of the FastAPI endpoint located at packages/dbgpt-serve/src/dbgpt_serve/agent/hub/controller.py. An authenticated attacker can remotely upload arbitrary files to the system, potentially achieving remote code execution or system compromise. A public proof-of-concept exploit is available on GitHub, and the vendor has not responded to early disclosure attempts, indicating patches may not be forthcoming.
SQL injection in eosphoros-ai db-gpt versions up to 0.7.5 allows unauthenticated remote attackers to manipulate the /api/v1/editor/ endpoint and execute arbitrary database queries. Public exploit code is available for this vulnerability, and no patch has been released despite vendor notification. This vulnerability impacts confidentiality, integrity, and availability of affected systems.
Path traversal in DB-GPT versions 0.7.0 through 0.7.2 allows unauthenticated remote attackers to read or write files outside the intended directory by supplying crafted path sequences in the File argument of the AWEL flow import endpoint at /api/v2/serve/awel/flow/import. A proof-of-concept has been publicly disclosed via the eosphoros-ai GitHub issue tracker, materially lowering the bar for opportunistic exploitation against internet-exposed instances. No vendor-released patched version has been confirmed at time of analysis, leaving affected deployments without an official upstream fix.
eosphoros-ai/DB-GPT version latest is vulnerable to arbitrary file deletion on Windows systems via the '/v1/agent/hub/update' endpoint. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In version 0.6.0 of eosphoros-ai/db-gpt, the `uvicorn` app created by `dbgpt_server` uses an overly permissive instance of `CORSMiddleware` which sets the `Access-Control-Allow-Origin` to `*` for all. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /v1/personal/agent/upload` is vulnerable to Arbitrary File Upload with Path Traversal. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /api/v1/editor/chart/run` allows execution of arbitrary SQL queries without any access control. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /api/v1/editor/sql/run` allows execution of arbitrary SQL queries without any access control. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
eosphoros-ai/db-gpt version 0.6.0 contains a vulnerability in the RAG-knowledge endpoint that allows for arbitrary file write. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
eosphoros-ai/db-gpt version 0.6.0 is vulnerable to an arbitrary file write through the knowledge API. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In eosphoros-ai/db-gpt version 0.6.0, the endpoint for uploading files is vulnerable to absolute path traversal. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A Path Traversal vulnerability exists in the eosphoros-ai/db-gpt version 0.6.0 at the API endpoint `/v1/resource/file/delete`. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A Denial of Service (DoS) vulnerability in the multipart request boundary processing mechanism of eosphoros-ai/db-gpt v0.6.0 allows unauthenticated attackers to cause excessive resource consumption. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
DB-GPT through 0.8.2 ships a default docker-compose.yml that hardcodes the MySQL root password and publishes port 3306 on every host interface, so any instance deployed with the stock configuration exposes a root@% database account with publicly known credentials. An unauthenticated remote attacker who can reach port 3306, or who has a foothold on the shared 'dbgptnet' Docker bridge network, can log in with that static password and inherit FILE and SUPER privileges - full read/write access to all DB-GPT data plus the ability to read or write files on the database host. Publicly available exploit code exists (referenced by VulnCheck and Lasso Security); the issue is not in CISA KEV, but any deployment left in its default state is directly exploitable, and operators who rotated the root password, bound 3306 to localhost, or firewalled the host are materially less exposed.
Unauthenticated remote code execution in DB-GPT through 0.8.2 allows remote attackers to reach the /api/v1/chat/react-agent endpoint, where a mock get_user_from_headers function grants every caller the admin role. Crafted prompts can cause the ReAct agent's unsandboxed code_interpreter and shell_interpreter tools to execute arbitrary Python or bash as root in the webserver container, potentially reaching the bundled database with default credentials. Publicly available exploit code exists; the provided data does not confirm active exploitation, and the assessed CVSS 3.1 severity is 9.3 with network access, no privileges, and no user interaction required when the endpoint and interpreter tools are deployed and reachable.
Path traversal in DB-GPT 0.7.5 and 0.8.0 lets remote attackers write arbitrary files outside the intended upload workspace through the OpenAPI python_file_upload endpoint at packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py:42. The affected service is the DB-GPT web API and the vector is rated critical (CVSS 9.1, AV:N/AC:L/PR:N/UI:N), so exploitation hinges on network reachability of the instance rather than on any attacker-held credentials - DB-GPT ships its API without enforced authentication by default, which is why the score is PR:N. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis; EPSS is low at 0.47% (38th percentile), so this is a genuine but not yet mass-exploited issue. Note a scoring divergence: NVD rates confidentiality and integrity high with no availability impact, while our independent assessment rates integrity and availability high and confidentiality none.
Unauthenticated arbitrary file write in DB-GPT 0.8.0 lets remote attackers achieve remote code execution through the skill_upload endpoint, which builds an upload path by joining the user-controlled multipart filename to the upload directory without canonicalisation or containment checks. Because the route's only auth dependency (get_user_from_headers) returns an admin-role request even when no credentials are supplied, an attacker with no account can write a .py file such as ../../../tmp/x or /tmp/x anywhere the server process can write, then plant or overwrite a Python module that executes when next imported. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the flaw is trivially exploitable and fixed in v0.8.1.
An unrestricted file upload vulnerability exists in eosphoros-ai DB-GPT versions up to 0.7.5 within the module_plugin.refresh_plugins function of the FastAPI endpoint located at packages/dbgpt-serve/src/dbgpt_serve/agent/hub/controller.py. An authenticated attacker can remotely upload arbitrary files to the system, potentially achieving remote code execution or system compromise. A public proof-of-concept exploit is available on GitHub, and the vendor has not responded to early disclosure attempts, indicating patches may not be forthcoming.
SQL injection in eosphoros-ai db-gpt versions up to 0.7.5 allows unauthenticated remote attackers to manipulate the /api/v1/editor/ endpoint and execute arbitrary database queries. Public exploit code is available for this vulnerability, and no patch has been released despite vendor notification. This vulnerability impacts confidentiality, integrity, and availability of affected systems.
Path traversal in DB-GPT versions 0.7.0 through 0.7.2 allows unauthenticated remote attackers to read or write files outside the intended directory by supplying crafted path sequences in the File argument of the AWEL flow import endpoint at /api/v2/serve/awel/flow/import. A proof-of-concept has been publicly disclosed via the eosphoros-ai GitHub issue tracker, materially lowering the bar for opportunistic exploitation against internet-exposed instances. No vendor-released patched version has been confirmed at time of analysis, leaving affected deployments without an official upstream fix.
eosphoros-ai/DB-GPT version latest is vulnerable to arbitrary file deletion on Windows systems via the '/v1/agent/hub/update' endpoint. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In version 0.6.0 of eosphoros-ai/db-gpt, the `uvicorn` app created by `dbgpt_server` uses an overly permissive instance of `CORSMiddleware` which sets the `Access-Control-Allow-Origin` to `*` for all. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /v1/personal/agent/upload` is vulnerable to Arbitrary File Upload with Path Traversal. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /api/v1/editor/chart/run` allows execution of arbitrary SQL queries without any access control. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /api/v1/editor/sql/run` allows execution of arbitrary SQL queries without any access control. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
eosphoros-ai/db-gpt version 0.6.0 contains a vulnerability in the RAG-knowledge endpoint that allows for arbitrary file write. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
eosphoros-ai/db-gpt version 0.6.0 is vulnerable to an arbitrary file write through the knowledge API. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In eosphoros-ai/db-gpt version 0.6.0, the endpoint for uploading files is vulnerable to absolute path traversal. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A Path Traversal vulnerability exists in the eosphoros-ai/db-gpt version 0.6.0 at the API endpoint `/v1/resource/file/delete`. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A Denial of Service (DoS) vulnerability in the multipart request boundary processing mechanism of eosphoros-ai/db-gpt v0.6.0 allows unauthenticated attackers to cause excessive resource consumption. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.