CVE-2025-0452

eosphoros-ai/DB-GPT version latest is vulnerable to arbitrary file deletion on Windows systems via the '/v1/agent/hub/update' endpoint. The application fails to properly filter the '\' character, which is commonly used as a separator in Windows paths. This vulnerability allows attackers to delete any files on the host system by manipulating the 'plugin_repo_name' variable.

• CWE-73

• https://huntr.com/bounties/7e854343-3d61-47d4-ad41-c4d2f356a54aExploit, Third Party Advisory

Published

Mar 20, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-0445Use after free in V8 in Google Chrome prior to 133.0.6943.53…5.4
• CVE-2025-0446Inappropriate implementation in Extensions in Google Chrome …4.3
• CVE-2025-0447Inappropriate implementation in Navigation in Google Chrome …8.8
• CVE-2025-0448Inappropriate implementation in Compositing in Google Chrome…4.3
• CVE-2025-0450The Betheme plugin for WordPress is vulnerable to Stored Cro…5.4
• CVE-2025-0451Inappropriate implementation in Extensions API in Google Chr…6.3
• CVE-2025-0453In mlflow/mlflow version 2.17.2, the `/graphql` endpoint is …7.5
• CVE-2025-0454A Server-Side Request Forgery (SSRF) vulnerability was ident…7.5
• CVE-2025-0455The airPASS from NetVision Information has a SQL Injection v…9.8
• CVE-2025-0456The airPASS from NetVision Information has a Missing Authent…9.8
• CVE-2025-0457The airPASS from NetVision Information has an OS Command Inj…8.8
• CVE-2025-0458A vulnerability classified as problematic was found in Virtu…6.9