Medium severity · published Mar 20, 2026
CVE-2026-4505
eosphoros-ai DB-GPT FastAPI Endpoint controller.py module_plugin.refresh_plugins unrestricted upload
6.3
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability has been found in eosphoros-ai DB-GPT up to 0.7.5. This issue affects the function module_plugin.refresh_plugins of the file packages/dbgpt-serve/src/dbgpt_serve/agent/hub/controller.py of the component FastAPI Endpoint. Such manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DB
DB-GPT · eosphoros-ai
0.7.0; 0.7.1; 0.7.2; 0.7.3; 0.7.4; 0.7.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-4505
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-4505
github.com
https://github.com/Ka7arotto/cve/blob/main/DB-gpt-uploadrce.md
vuldb.com
https://vuldb.com/?ctiid.352071
vuldb.com
https://vuldb.com/?id.352071
vuldb.com
https://vuldb.com/?submit.773897
More from DB-GPT
9.8
CVE-2026-77933
DB-GPT through 0.8.2 Hardcoded MySQL Root Credentials in docker-compose Deployment
9.8
CVE-2026-77932
DB-GPT through 0.8.2 Unauthenticated RCE via /api/v1/chat/react-agent
9.8
CVE-2026-80104
DB-GPT 0.8.0 Path Traversal Arbitrary File Write via Skill Upload Filename
9.8
CVE-2026-73034
DB-GPT v0.8.1 Path Traversal Arbitrary File Write via user_id Header
7.5
CVE-2025-6772
eosphoros-ai db-gpt import import_flow path traversal