Arbitrary file write in eosphoros-ai/db-gpt knowledge API (CVE-2024-10833)
Date: 2024
Affected: eosphoros-ai/db-gpt 0.6.0
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: Critical

db-gpt 0.6.0 knowledge-upload endpoint is susceptible to absolute-path traversal, allowing attackers to write files to arbitrary locations on the server.


Mitigations:

Architectural layers (MAESTRO):