CVSS 3.0
8.2 highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:HCVE-2025-0452
High (8.2) in dbgpt db-gpt. EPSS 0.6% chance of exploitation in the next 30 days.
eosphoros-ai/DB-GPT version latest is vulnerable to arbitrary file deletion on Windows systems via the '/v1/agent/hub/update' endpoint. The application fails to properly filter the '\' character, which is commonly used as a separator in Windows paths. This vulnerability allows attackers to delete any files on the host system by manipulating the 'plugin_repo_name' variable.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
- CWE
- CWE-73
- Published
- Modified
- Record from
- the NVD, synced
Affected
- dbgpt:db-gpt