CVE-2024-10830: Path Traversal in dbgpt

The impact of this vulnerability is significant, as a successful attacker can delete any file accessible to the db-gpt process. This includes critical configuration files, database backups, or even application code, potentially leading to complete system compromise or denial of service. An attacker could leverage this to gain persistent access or disrupt operations. The ability to delete arbitrary files represents a severe security risk, particularly in environments where db-gpt handles sensitive data or interacts with other critical systems. While no immediate exploitation reports are public, the ease of exploitation makes it a high-priority concern.

1. Reserved2024-11-04
2. Published2025-03-20
3. Modified2025-03-21
4. EPSS updated2026-04-02

The primary mitigation is to upgrade to a patched version of db-gpt that addresses this vulnerability. Since a fixed version is not yet specified, consider implementing temporary workarounds. Restrict access to the /v1/resource/file/delete endpoint to authorized users only, using authentication and authorization mechanisms. Implement strict input validation on the file_key parameter, ensuring it only accepts expected values and does not contain path traversal characters (e.g., ..). Consider using a Web Application Firewall (WAF) to filter requests containing suspicious file paths. After upgrading, verify the fix by attempting to access and delete a non-existent file via the /v1/resource/file/delete endpoint; the request should be rejected.