Eosphoros-Ai
14 CVEs across 2 Eosphoros-Ai products. Browse Eosphoros-Ai vulnerabilities, severities, and proof-of-concept exploits.
Eosphoros-Ai products with known CVEs
Eosphoros-Ai CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-73034 | Critical | 9.8 | 2026-08-11 | DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by i… |
CVE-2026-4505 | Medium | 6.3 | 2026-03-20 | A vulnerability has been found in eosphoros-ai DB-GPT up to 0.7.5. This issue affects the function module_plugin.refresh_plugins of the file packages/dbgpt-ser… |
CVE-2026-4504 | High | 7.3 | 2026-03-20 | A flaw has been found in eosphoros-ai db-gpt up to 0.7.5. This vulnerability affects unknown code of the file /api/v1/editor/ of the component Incomplete Fix… |
CVE-2026-3409 | High | 7.3 | 2026-03-02 | A security flaw has been discovered in eosphoros-ai db-gpt 0.7.5. Affected is the function importlib.machinery.SourceFileLoader.exec_module of the file /api/v1… |
CVE-2025-6772 | High | 7.3 | 2025-06-27 | A vulnerability was found in eosphoros-ai db-gpt up to 0.7.2. It has been classified as critical. Affected is the function import_flow of the file /api/v2/serv… |
CVE-2025-0452 | High | 8.2 | 2025-03-20 | eosphoros-ai/DB-GPT version latest is vulnerable to arbitrary file deletion on Windows systems via the '/v1/agent/hub/update' endpoint. The application fails t… |
CVE-2024-10906 | High | 8.1 | 2025-03-20 | In version 0.6.0 of eosphoros-ai/db-gpt, the `uvicorn` app created by `dbgpt_server` uses an overly permissive instance of `CORSMiddleware` which sets the `Acc… |
CVE-2024-10902 | Critical | 9.8 | 2025-03-20 | In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /v1/personal/agent/upload` is vulnerable to Arbitrary File Upload with Path Traversal. This vulnerabil… |
CVE-2024-10901 | Critical | 9.8 | 2025-03-20 | In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /api/v1/editor/chart/run` allows execution of arbitrary SQL queries without any access control. This v… |
CVE-2024-10835 | Critical | 9.8 | 2025-03-20 | In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /api/v1/editor/sql/run` allows execution of arbitrary SQL queries without any access control. This vul… |
CVE-2024-10834 | Critical | 9.1 | 2025-03-20 | eosphoros-ai/db-gpt version 0.6.0 contains a vulnerability in the RAG-knowledge endpoint that allows for arbitrary file write. The issue arises from the abilit… |
CVE-2024-10833 | Critical | 9.1 | 2025-03-20 | eosphoros-ai/db-gpt version 0.6.0 is vulnerable to an arbitrary file write through the knowledge API. The endpoint for uploading files as 'knowledge' is suscep… |
CVE-2024-10831 | Critical | 9.1 | 2025-03-20 | In eosphoros-ai/db-gpt version 0.6.0, the endpoint for uploading files is vulnerable to absolute path traversal. This vulnerability allows an attacker to uploa… |
CVE-2024-10830 | High | 8.2 | 2025-03-20 | A Path Traversal vulnerability exists in the eosphoros-ai/db-gpt version 0.6.0 at the API endpoint `/v1/resource/file/delete`. This vulnerability allows an att… |
CVE-2024-10829 | High | 7.5 | 2025-03-20 | A Denial of Service (DoS) vulnerability in the multipart request boundary processing mechanism of eosphoros-ai/db-gpt v0.6.0 allows unauthenticated attackers t… |