CVE-2024-10902: Path Traversal in db-gpt

The primary impact of CVE-2024-10902 is the ability for an attacker to upload arbitrary files to the server. This is a severe risk because it can be leveraged for remote code execution (RCE). Specifically, the description highlights the possibility of writing a malicious init.py file into the Python /site-packages/ directory, which would execute upon import. This could grant the attacker complete control over the affected system. The path traversal aspect means the attacker isn't limited to a specific upload directory; they can choose any location on the file system, significantly expanding the potential damage. Successful exploitation could lead to data breaches, system compromise, and denial of service.

1. Reserved2024-11-05
2. Published2025-03-20
3. Modified2025-10-16
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-10902 is to upgrade to a patched version of eosphoros-ai/db-gpt. Unfortunately, a fixed version is not specified in the provided data. As a temporary workaround, implement strict file upload validation on the POST /v1/personal/agent/upload endpoint. This should include whitelisting allowed file extensions and rigorously validating the file path to prevent traversal attempts. Consider using a Web Application Firewall (WAF) with rules to block suspicious file uploads and path manipulation attempts. Regularly scan the file system for unexpected or unauthorized files. After applying mitigations, verify the upload endpoint's security by attempting to upload a file with a deliberately malicious path.