CVE-2025-51459 – Eosphoros-ai DB-GPT File Upload RCE

CVE ID : CVE-2025-51459

Published : July 22, 2025, 7:15 p.m. | 1 hour, 44 minutes ago

Description : File Upload vulnerability in agent.hub.controller.refresh_plugins in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary code via a malicious plugin ZIP file uploaded to the /v1/personal/agent/upload endpoint, interacting with plugin_hub._sanitize_filename and plugins_util.scan_plugins.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…