CVE-2025-0452
eosphoros-ai/DB-GPT version latest is vulnerable to arbitrary file deletion on Windows systems via the '/v1/agent/hub/update' endpoint. The application fails to properly filter the '\' character, which is commonly used as a separator in Windows paths. This vulnerability allows attackers to delete any files on the host system by manipulating the 'plugin_repo_name' variable.
Vendor
Product
CWE
Yayın Tarihi
2025-03-20 10:15:52
Güncelleme
2025-07-17 15:56:28
Source Identifier
security@huntr.dev
KEV Date Added
-