https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 10:28:33 +0000 https://cve.radiocsirt.org/vuln/cve-2024-10833 <p><strong>Affected:</strong> eosphoros-ai/db-gpt</p> <p>eosphoros-ai/db-gpt version 0.6.0 is vulnerable to an arbitrary file write through the knowledge API. The endpoint for uploading files as &#39;knowledge&#39; is susceptible to absolute path traversal, allowing attackers to write files to arbitrary locations on the target server. This vulnerability arises because the &#39;doc_file.filename&#39; parameter is user-controllable, enabling the construction of absolute paths.</p> <p><strong>Affected:</strong> eosphoros-ai/db-gpt</p> <p>eosphoros-ai/db-gpt version 0.6.0 is vulnerable to an arbitrary file write through the knowledge API. The endpoint for uploading files as &#39;knowledge&#39; is susceptible to absolute path traversal, allowing attackers to write files to arbitrary locations on the target server. This vulnerability arises because the &#39;doc_file.filename&#39; parameter is user-controllable, enabling the construction of absolute paths.</p> https://cve.radiocsirt.org/vuln/cve-2024-10833