Absolute Path Traversal Vulnerability in eosphoros-ai/db-gpt File Upload Function

CVE-2024-10831

What is CVE-2024-10831?

In eosphoros-ai/db-gpt version 0.6.0, a critical vulnerability exists in the file upload mechanism that allows for absolute path traversal. By manipulating user-controlled parameters, such as file_key and doc_file.filename, attackers can upload files to unintended locations on the server. This can lead to severe consequences, including overwriting sensitive system files like SSH keys, potentially enabling further exploitation of the server.

References