repository icon
eosphoros-ai / db-gpt Project repository

AI Native Data App Development framework with AWEL(Agentic Workflow Expression Language) and Agents

Submit a report

FIRST INTERACTION

WITHINN/A DAYS

REVIEW

WITHIN19 DAYS

FIX

WITHINN/A DAYS

Prompt injection in eosphoros-ai/db-gpt leading to arbitrary code execution
glmgbj233
self closed
Regular expression Denial of Service - ReDoS
tatianahub
pending
Arbitrary File Upload with Path Traversal via POST /api/v1/personal/agent/upload
xcx1r3
duplicate
Critical
Arbitrary file write
hoanpham1
duplicate
Critical
Arbitrary file write
hoanpham1
duplicate
Critical
Arbitrary file deletion on Windows via the '/v1/agent/hub/update' endpoint.
williwollo
High
•$300•CVE-2025-0452
Abitrary file write via '/v1/resource/file/upload' endpoint
williwollo
duplicate
Critical
Abitrary file write via 'knowledge/{space_name}/document/upload' endpoint
williwollo
duplicate
Critical
Arbitrary File Write through API `v1/personal/agent/upload` leads to RCE
jackfromeast
duplicate
Critical
Writing arbitrary files leads to RCE in the Knowledge creation function
ngductung
duplicate
Critical
Path Traversal During Document Upload Can Lead to RCE
r0path
duplicate
High
Denial of service
oicu0619
duplicate
High
SSRF in `/api/v1/chat/db/test/connect`
bidaya0
informative
High
Insecure file upload mechanism on /api/v1/resource/file/upload
bidaya0
duplicate
Critical
A CSRF vulnerability has been identified in the `/prompt/update` and `/construct...
bidaya0
duplicate
Medium
CSRF due to the default use of CORS-middleware in dbgpt_server
patrik-ha
High
•$300•CVE-2024-10906
Insecure file upload mechanism on /knowledge/{space_name}/document/upload
bidaya0
duplicate
Critical
Prompt injection which leads to arbitrary code execution in dbgpt.core.interface...
bidaya0
informative
High
Arbitrary File Upload with Path Traversal via POST /knowledge/{space_name}/docum...
zpbrent
duplicate
Critical
Arbitrary File Upload with Path Traversal via POST /api/v2/serve/knowledge/docum...
zpbrent
duplicate
Critical
Arbitrary file write through plugin upload
patrik-ha
duplicate
Critical
Arbitrary File Upload with Path Traversal via POST /v1/personal/agent/upload
zpbrent
Critical
•$600•CVE-2024-10902
Arbitrary File Write via DuckDB SQL Injection in POST /api/v1/editor/chart/run
zpbrent
Critical
•$600•CVE-2024-10901
Arbitrary File Write via DuckDB SQL Injection in POST /api/v1/editor/sql/run
zpbrent
Critical
•$600•CVE-2024-10835
Arbitrary file write through RAG-knowledge endpoint
patrik-ha
Critical
•$600•CVE-2024-10834
Arbitrary File Upload with Path Traversal via POST /api/v1/resource/file/upload
zpbrent
duplicate
Critical
Arbitrary File Delete via POST /api/v1/resource/file/delete
zpbrent
duplicate
Critical
Arbitrary file write through knowledge API
patrik-ha
Critical
•$600•CVE-2024-10833
Arbitrary file write through absolute path traversal
patrik-ha
Critical
•$600•CVE-2024-10831
Remote file deletion through web-API
patrik-ha
duplicate
Critical
Path Traversal
past3l
spam
CORS misconfiguration leads to data leak
srivallikusumba
pending
Unauthenticated DoS via multipart boundry
mnqazi
High
•$300•CVE-2024-10829
Path Traversal in api `/v1/resource/file/delete`
tungpentest
High
•$300•CVE-2024-10830
Path Traversal at API `/v1/resource/file/read`
ngductung
informative
Medium