Eosphoros AI DB-GPT Arbitrary File Upload Vulnerability with Path Traversal

An arbitrary file upload vulnerability with path traversal has been identified in the Eosphoros AI DB-GPT web API, specifically in version 0.6.0. The issue arises in the `POST /v1/personal/agent/upload` endpoint, where unauthorized attackers can upload files to any location on the victim's file system. This vulnerability could lead to remote code execution by allowing the upload of malicious files, such as a harmful `__init__.py` file placed in Python's `/site-packages/` directory.

Impact

Exploitation of this vulnerability could result in unauthorized file uploads, with the potential for remote code execution if malicious files are uploaded and executed on the server.