Arbitrary File Deletion Vulnerability in DB-GPT by Eosphoros AI
CVE-2025-0452

8.2HIGH

Key Information:

Vendor

Eosphoros-ai

Status
Eosphoros-ai/db-gpt
Vendor
CVE Published:
20 March 2025

What is CVE-2025-0452?

The DB-GPT application by Eosphoros AI has a vulnerability that allows for arbitrary file deletion on Windows systems. This issue arises due to improper filtering of the backslash ('') character in the endpoint '/v1/agent/hub/update'. Attackers can exploit this flaw by manipulating the 'plugin_repo_name' variable, enabling them to delete files on the host system without authorization, which poses significant security risks.

Affected Version(s)

eosphoros-ai/db-gpt <= unspecified

References

https://huntr.com/bounties/7e854343-3d61-47d4-ad41-c4d2f3...

CVSS V3.0

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.