DB-GPT is a modestly represented but more prominent than typical vendor focused on a narrowly scoped data analytics and database interface product. Vulnerabilities affecting the vendor skew strongly toward critical-severity outcomes and recur persistently through path-traversal, SQL-injection, and cross-site request forgery weaknesses that reflect the product's file-handling and query-processing attack surface. Defenders should treat this vendor's advisories as high-priority despite its focused portfolio, as the proximity of these critical flaws to database and file-system operations creates significant exposure; live exploitation and severity counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Dbgpt over time
Signals from CVEs in this vendor scope (13 CVEs).
13 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-10833CRITICAL eosphoros-ai/db-gpt version 0.6.0 is vulnerable to an arbitrary file write through the knowledge API. The endpoint for uploading files as 'knowledge' is susceptible to absolute pat | Mar 20, 2025 | 9.1 | 28 | NO | NO |
CVE-2024-10902CRITICAL In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /v1/personal/agent/upload` is vulnerable to Arbitrary File Upload with Path Traversal. This vulnerability allows unauthoriz | Mar 20, 2025 | 9.8 | 27 | NO | NO |
CVE-2024-10901CRITICAL In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /api/v1/editor/chart/run` allows execution of arbitrary SQL queries without any access control. This vulnerability can be e | Mar 20, 2025 | 9.8 | 26 | NO | NO |
CVE-2024-10835CRITICAL In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /api/v1/editor/sql/run` allows execution of arbitrary SQL queries without any access control. This vulnerability can be exp | Mar 20, 2025 | 9.8 | 26 | NO | NO |
CVE-2024-10831CRITICAL In eosphoros-ai/db-gpt version 0.6.0, the endpoint for uploading files is vulnerable to absolute path traversal. This vulnerability allows an attacker to upload arbitrary files to | Mar 20, 2025 | 9.1 | 25 | NO | NO |
CVE-2024-10834CRITICAL eosphoros-ai/db-gpt version 0.6.0 contains a vulnerability in the RAG-knowledge endpoint that allows for arbitrary file write. The issue arises from the ability to pass an absolute | Mar 20, 2025 | 9.1 | 24 | NO | NO |
CVE-2024-10830HIGH A Path Traversal vulnerability exists in the eosphoros-ai/db-gpt version 0.6.0 at the API endpoint `/v1/resource/file/delete`. This vulnerability allows an attacker to delete any f | Mar 20, 2025 | 8.2 | 23 | NO | NO |
CVE-2025-0452HIGH eosphoros-ai/DB-GPT version latest is vulnerable to arbitrary file deletion on Windows systems via the '/v1/agent/hub/update' endpoint. The application fails to properly filter the | Mar 20, 2025 | 8.2 | 22 | NO | NO |
CVE-2024-10906HIGH In version 0.6.0 of eosphoros-ai/db-gpt, the `uvicorn` app created by `dbgpt_server` uses an overly permissive instance of `CORSMiddleware` which sets the `Access-Control-Allow-Ori | Mar 20, 2025 | 8.1 | 22 | NO | NO |
CVE-2025-6772HIGH A vulnerability was found in eosphoros-ai db-gpt up to 0.7.2. It has been classified as critical. Affected is the function import_flow of the file /api/v2/serve/awel/flow/import. T | Jun 27, 2025 | 7.5 | 21 | NO | NO |
Signals from CVEs in this vendor scope (13 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Dbgpt.
Media articles that mention a CVE ID that affects a product developed by Dbgpt — matched by CVE ID, not by vendor name.