PatchTheCVEdbgpt vulnerabilities
Recent CVEs affecting dbgpt products. 13 tracked.
dbgpt has 13 tracked vulnerabilities, 6 critical. A fixed release or vendor patch exists for 1. Most recent: 2025-07-22. Highest priority: CVE-2024-10902 (score 62/100).
- CVE-2025-6772 HIGH 7.3 UPGRADE A vulnerability was found in eosphoros-ai db-gpt up to 0.7.2
- CVE-2025-51459 MEDIUM 6.5 DOWNGRADE File Upload vulnerability in agent.hub.controller.refresh_plugins in eosphoros-ai DB-GPT 0.7.0 allows remote a
- CVE-2025-51458 MEDIUM 6.5 DOWNGRADE SQL Injection in editor_sql_run and query_ex in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute a
- CVE-2025-0452 HIGH 8.2 DOWNGRADE eosphoros-ai/DB-GPT version latest is vulnerable to arbitrary file deletion on Windows systems via the '/v1/ag
- CVE-2024-10906 HIGH 8.1 DOWNGRADE In version 0.6.0 of eosphoros-ai/db-gpt, the `uvicorn` app created by `dbgpt_server` uses an overly permissive
- CVE-2024-10902 CRITICAL 9.8 DOWNGRADE In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /v1/personal/agent/upload` is vulnerable to Arbitrary
- CVE-2024-10901 CRITICAL 9.8 DOWNGRADE In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /api/v1/editor/chart/run` allows execution of arbitra
- CVE-2024-10835 CRITICAL 9.8 DOWNGRADE In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /api/v1/editor/sql/run` allows execution of arbitrary
- CVE-2024-10834 CRITICAL 9.1 DOWNGRADE eosphoros-ai/db-gpt version 0.6.0 contains a vulnerability in the RAG-knowledge endpoint that allows for arbit
- CVE-2024-10833 CRITICAL 9.1 DOWNGRADE eosphoros-ai/db-gpt version 0.6.0 is vulnerable to an arbitrary file write through the knowledge API
- CVE-2024-10831 CRITICAL 9.1 DOWNGRADE In eosphoros-ai/db-gpt version 0.6.0, the endpoint for uploading files is vulnerable to absolute path traversa
- CVE-2024-10830 HIGH 8.2 DOWNGRADE A Path Traversal vulnerability exists in the eosphoros-ai/db-gpt version 0.6.0 at the API endpoint `/v1/resour
- CVE-2024-10829 HIGH 7.5 DOWNGRADE A Denial of Service (DoS) vulnerability in the multipart request boundary processing mechanism of eosphoros-ai
FAQ
How do I fix dbgpt vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is dbgpt being exploited right now?
None of the tracked dbgpt CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which dbgpt CVE should I patch first?
CVE-2024-10902 currently ranks highest (62/100): In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /v1/personal/agent/upload` is vulnerable to Arbitrary.