DB-GPT versions 0.7.5 and 0.8.0 contain a directory traversal flaw in the use_example_file function of the examples API. The target path is built from the example name without validation, so a name containing traversal sequences can cause files to be written outside the user upload directory. The reporter describes arbitrary file writes that could lead to configuration tampering or code execution, which is not verified. Exploitation depends on the example name being manipulated, for example through configuration or database changes, and the reporter says authenticated access is needed, which conflicts with the CVSS vector.
eosphoros-ai · DB-GPT
DB-GPT through 0.8.2 ships a docker-compose.yml with a fixed MySQL root password (aa123456) and publishes MySQL port 3306 on all interfaces. An attacker who can reach port 3306, or any container on the shared dbgptnet network, can log in as root@% without further authentication and gain full access to all databases, including FILE and SUPER privileges. The issue applies to deployments that use the default compose file without changes.
eosphoros-ai · DB-GPT
DB-GPT through 0.8.2 contains an authentication bypass in the /api/v1/chat/react-agent endpoint. A mock user function grants every caller the admin role, so unauthenticated attackers can send prompts that make the agent run arbitrary Python or bash commands as root in the webserver container. The bundled database can also be reached with default credentials, which may expose data and enable further attacks on the network.
eosphoros-ai · DB-GPT
In DB-GPT v0.8.0, the sandbox service can silently use LocalRuntime, which runs submitted code directly on the host instead of in a container. The fallback applies when no container runtime (Docker, Podman or Nerdctl) is available, and the default setting SANDBOX_RUNTIME=local also selects it. An attacker who can reach the sandbox HTTP API, or who can get the AI agent to generate code through the Web UI, may run arbitrary commands with the privileges of the DB-GPT process. Secondary reports describe this as requiring no authentication, which the vendor has not confirmed.
eosphoros-ai · DB-GPT
DB-GPT versions 0.7.5 and 0.8.0 allow a skill uploaded through the skill upload API to be executed later through the ReAct agent chat flow. According to the public issue report, the uploaded script is wrapped into Python and started on the host, so an attacker who can use the upload and chat endpoints can run code with the privileges of the DB-GPT process. The CVE record rates the impact as total (CVSS 9.8). Whether authentication is required on these endpoints is not confirmed in the sources.
eosphoros-ai · DB-GPT
DB-GPT v0.7.5 and v0.8.0 contain a directory traversal flaw in the Python file upload function (python_file_upload). The uploaded filename is used without validation, so crafted path sequences such as ../ can place a .py file outside the user's upload directory. The issue report describes this as exploitable by authenticated users, while the CVSS vector indicates no privileges or user interaction are required. Written Python files can later be imported or executed by the application, so the impact can extend to code execution.
eosphoros-ai · DB-GPT
DB-GPT 0.8.0 contains a directory traversal in the skill_upload handler. A remote attacker can supply a crafted filename with ../ sequences to write files outside the upload directory, which could overwrite application code or configuration. The public issue describes the attack as requiring an authenticated user, while other sources describe unauthenticated access; the worst case is assumed here.
eosphoros-ai · DB-GPT
