File Upload vulnerability in agent.hub.controller.refresh_plugins in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary code via a malicious plugin ZIP file uploaded to the /v1/personal/agent/upload endpoint, interacting with plugin_hub._sanitize_filename and plugins_util.scan_plugins.
References
| Link | Resource |
|---|---|
| https://github.com/eosphoros-ai/DB-GPT/pull/2649 | Exploit Issue Tracking |
| https://www.gecko.security/blog/cve-2025-51459 | Exploit Third Party Advisory |
Configurations
History
11 Sep 2025, 16:13
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:dbgpt:db-gpt:0.7.0:*:*:*:*:*:*:* | |
| First Time |
Dbgpt
Dbgpt db-gpt |
|
| References | () https://github.com/eosphoros-ai/DB-GPT/pull/2649 - Exploit, Issue Tracking | |
| References | () https://www.gecko.security/blog/cve-2025-51459 - Exploit, Third Party Advisory |
25 Jul 2025, 15:29
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
22 Jul 2025, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| CWE | CWE-77 |
22 Jul 2025, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-07-22 19:15
Updated : 2025-09-11 16:13
NVD link : CVE-2025-51459
Mitre link : CVE-2025-51459
CVE.ORG link : CVE-2025-51459
JSON object : View
Products Affected
dbgpt
- db-gpt
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')