Arbitrary file write in db-gpt RAG-knowledge endpoint (CVE-2024-10834)
Date: 2024
Affected: eosphoros-ai/db-gpt 0.6.0
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: Critical

db-gpt 0.6.0 contains an arbitrary-file-write vulnerability in the RAG-knowledge endpoint.


Mitigations:

Architectural layers (MAESTRO):