CVE-2024-10830

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-10830
A Path Traversal vulnerability exists in the eosphoros-ai/db-gpt version 0.6.0 at the API endpoint `/v1/resource/file/delete`. This vulnerability allows an attacker to delete any file on the server by manipulating the `file_key` parameter. The `file_key` parameter is not properly sanitized, enabling an attacker to specify arbitrary file paths. If the specified file exists, the application will delete it.

8.2 /10

CVSS v3 : HIGH

V3 Legend

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://huntr.com/bounties/26adf08a-9262-4d5a-a2ee-ce12ed919620 Exploit Third Party Advisory
https://huntr.com/bounties/26adf08a-9262-4d5a-a2ee-ce12ed919620 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:dbgpt:db-gpt:0.6.0:*:*:*:*:*:*:*
History

17 Jul 2025, 13:37

Type Values Removed Values Added
First Time Dbgpt
Dbgpt db-gpt
References () https://huntr.com/bounties/26adf08a-9262-4d5a-a2ee-ce12ed919620 - () https://huntr.com/bounties/26adf08a-9262-4d5a-a2ee-ce12ed919620 - Exploit, Third Party Advisory
Summary
  • (es) Existe una vulnerabilidad de Path Traversal en eosphoros-ai/db-gpt versión 0.6.0 en el endpoint de la API `/v1/resource/file/delete`. Esta vulnerabilidad permite a un atacante eliminar cualquier archivo del servidor manipulando el parámetro `file_key`. Este parámetro no se depura correctamente, lo que permite a un atacante especificar rutas de archivo arbitrarias. Si el archivo especificado existe, la aplicación lo eliminará.
CPE cpe:2.3:a:dbgpt:db-gpt:0.6.0:*:*:*:*:*:*:*

20 Mar 2025, 15:15

Type Values Removed Values Added
References () https://huntr.com/bounties/26adf08a-9262-4d5a-a2ee-ce12ed919620 - () https://huntr.com/bounties/26adf08a-9262-4d5a-a2ee-ce12ed919620 -

20 Mar 2025, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-20 10:15

Updated : 2025-07-17 13:37

NVD link : CVE-2024-10830

Mitre link : CVE-2024-10830

CVE.ORG link : CVE-2024-10830

JSON object : View

Products Affected

dbgpt

  • db-gpt
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')