| Package | Affected versions | Patched versions |
|---|---|---|
| dbgpt | ≤ 0.6.0 | |
| db-gpt | = 0.6.0 |
A Path Traversal vulnerability exists in the eosphoros-ai/db-gpt version 0.6.0 at the API endpoint /v1/resource/file/delete. This vulnerability allows an attacker to delete any file on the server by manipulating the file_key parameter. The file_key parameter is not properly sanitized, enabling an attacker to specify arbitrary file paths. If the specified file exists, the application will delete it.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free