CVE-2025-6772
Last modified
CVE-2025-6772 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. A vulnerability was found in eosphoros-ai db-gpt up to 0.7.2. It has been classified as critical. EPSS estimates a 0.52% chance of exploitation in the next 30 days.
Description
A vulnerability was found in eosphoros-ai db-gpt up to 0.7.2. It has been classified as critical. Affected is the function import_flow of the file /api/v2/serve/awel/flow/import. The manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Dbgpt | Db-Gpt | <= 0.7.2 |
References
- https://github.com/eosphoros-ai/DB-GPT/issues/2774Exploit, Issue Tracking
- https://vuldb.com/?ctiid.314088Permissions Required, VDB Entry
- https://vuldb.com/?id.314088Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.601028Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-6772?
How severe is CVE-2025-6772?
How do I fix CVE-2025-6772?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-67713Miniflux 2 is an open source feed reader. Versions 2.2.14 an…6.1
- CVE-2025-67715Weblate is a web based localization tool. In versions prior …4.3
- CVE-2025-67716The Auth0 Next.js SDK is a library for implementing user aut…5.7
- CVE-2025-67717ZITADEL is an open-source identity infrastructure tool. Vers…4.3
- CVE-2025-67718Form.io is a combined Form and API platform for Serverless a…8.7
- CVE-2025-67719Ibexa is a composable end-to-end DXP (Digital Experience Pla…8.5
- CVE-2025-67720Pyrofork is a modern, asynchronous MTProto API framework. Ve…6.5
- CVE-2025-67721Aircompressor is a library with ports of the Snappy, LZO, LZ…7.5
- CVE-2025-67722FreePBX is an open-source web-based graphical user interface…7.8
- CVE-2025-67723Discourse is an open source discussion platform. Versions pr…5.4
- CVE-2025-67724Tornado is a Python web framework and asynchronous networkin…6.1
- CVE-2025-67725Tornado is a Python web framework and asynchronous networkin…7.5
Are you affected by CVE-2025-6772?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST