DBGPT Db-gpt

Arbitrary File Upload with Path Traversal in eosphoros-ai/db-gpt

Arbitrary File Write via SQL Injection in eosphoros-ai/db-gpt

Arbitrary File Write via DuckDB SQL Injection in eosphoros-ai/db-gpt

Arbitrary File Write through Absolute Path Traversal in eosphoros-ai/db-gpt

Arbitrary File Write in eosphoros-ai/db-gpt

Arbitrary File Write in eosphoros-ai/db-gpt

Path Traversal in eosphoros-ai/db-gpt

Arbitrary File Deletion in eosphoros-ai/DB-GPT

Cross-Site Request Forgery (CSRF) in eosphoros-ai/db-gpt

Denial of Service (DoS) via Multipart Boundary in eosphoros-ai/db-gpt

eosphoros-ai db-gpt import import_flow path traversal

File Upload vulnerability in agent.hub.controller.refresh_plugins in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary code via a malicious plugin ZIP file uploaded to the /v1/personal/agent/upload endpoint, interacting with plugin_hub._sanitize_filename and plugins_util.scan_plugins.

SQL Injection in editor_sql_run and query_ex in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary SQL statements via crafted input passed to the /v1/editor/sql/run or /v1/editor/chart/run endpoints, interacting with api_editor_v1.editor_sql_run, editor_chart_run, and datasource.rdbms.base.query_ex.