CVE-2025-6772: Dbgpt Db-gpt Path Traversal Vulnerability

CVE-2025-6772 Overview

A critical path traversal vulnerability has been identified in eosphoros-ai DB-GPT, an open-source AI native data application development framework. The vulnerability exists in the import_flow function located at /api/v2/serve/awel/flow/import, where improper handling of the File argument allows attackers to traverse directory paths and potentially access or manipulate files outside the intended directory structure.

Critical Impact

Remote attackers can exploit this path traversal vulnerability to access sensitive files, potentially leading to information disclosure, configuration tampering, or further system compromise without requiring authentication.

Affected Products

• DB-GPT versions up to and including 0.7.2
• eosphoros-ai DB-GPT AWEL flow import functionality
• Systems exposing the /api/v2/serve/awel/flow/import endpoint

Discovery Timeline

• 2025-06-27 - CVE-2025-6772 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-6772

Vulnerability Analysis

This path traversal vulnerability (CWE-22) affects the flow import functionality within DB-GPT's AWEL (Agentic Workflow Expression Language) service layer. The import_flow function fails to properly sanitize or validate file path inputs provided through the File argument parameter. This insufficient input validation allows attackers to craft malicious file path strings containing directory traversal sequences (such as ../) to escape the intended file upload directory.

The vulnerability is remotely exploitable over the network and requires no authentication or user interaction, making it particularly concerning for internet-facing DB-GPT deployments. While the immediate impact includes potential read and write access to system files, the broader implications could include exposure of database credentials, API keys, or other sensitive configuration data stored on the server.

Root Cause

The root cause of this vulnerability is improper input validation in the import_flow function. When processing file upload requests, the function does not adequately sanitize the File parameter to prevent path traversal sequences. This allows malicious input to bypass intended directory restrictions, granting attackers access to files outside the designated upload directory. The lack of proper canonicalization and path validation enables attackers to reference arbitrary file system locations.

Attack Vector

The attack is conducted remotely over the network by sending specially crafted HTTP requests to the /api/v2/serve/awel/flow/import endpoint. An attacker manipulates the File argument to include path traversal sequences that navigate outside the intended directory structure. Since the vulnerability requires no authentication, any attacker with network access to the DB-GPT instance can potentially exploit this flaw. The exploit has been publicly disclosed, increasing the risk of active exploitation in the wild.

The vulnerability mechanism involves crafting malicious file path values containing sequences like ../ to traverse directories. When the server processes the import request, the unsanitized path is used to access or write files at attacker-controlled locations. For detailed technical analysis, refer to the GitHub Issue Discussion and VulDB CVE Entry Summary.

Detection Methods for CVE-2025-6772

Indicators of Compromise

• HTTP requests to /api/v2/serve/awel/flow/import containing path traversal sequences such as ../, ..%2f, or ..%5c in file parameters
• Unexpected file access patterns in application logs referencing directories outside the flow import directory
• Anomalous read or write operations to sensitive configuration files like /etc/passwd, environment files, or database credentials
• Web server logs showing repeated requests to the flow import endpoint with varying file path manipulations

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing path traversal patterns targeting the /api/v2/serve/awel/flow/import endpoint
• Configure intrusion detection systems (IDS) to alert on HTTP requests with directory traversal sequences in file upload parameters
• Enable detailed application logging for all flow import operations and monitor for suspicious file path references
• Deploy file integrity monitoring on sensitive system and configuration files to detect unauthorized access or modifications

Monitoring Recommendations

• Monitor all incoming requests to DB-GPT API endpoints for suspicious path patterns, particularly requests containing encoded traversal sequences
• Implement real-time alerting for any file operations that reference paths outside expected application directories
• Review access logs regularly for patterns indicating reconnaissance or exploitation attempts against the flow import functionality
• Establish baseline behavior for the flow import endpoint and alert on deviations such as unusual request volumes or parameter lengths

How to Mitigate CVE-2025-6772

Immediate Actions Required

• Restrict network access to the DB-GPT instance to trusted networks only until a patch is available
• Implement WAF rules to block requests containing path traversal sequences to the affected endpoint
• Audit existing DB-GPT deployments for signs of exploitation by reviewing application and access logs
• Consider temporarily disabling the flow import functionality if it is not business-critical

Patch Information

At the time of this advisory, users should monitor the DB-GPT GitHub repository for security updates and patch releases. Upgrade to a version newer than 0.7.2 when a fix becomes available from the vendor.

Workarounds

• Deploy a reverse proxy or WAF in front of DB-GPT to filter and sanitize incoming requests, blocking any containing path traversal patterns
• Implement network-level access controls to limit which IP addresses can reach the DB-GPT API endpoints
• Use application-level authentication middleware to require authentication before accessing the flow import endpoint
• Run the DB-GPT application with minimal file system permissions to limit the impact of potential path traversal exploitation

# Example nginx configuration to block path traversal attempts
location /api/v2/serve/awel/flow/import {
    # Block common path traversal patterns
    if ($request_uri ~* "\.\.") {
        return 403;
    }
    if ($request_uri ~* "%2e%2e") {
        return 403;
    }
    # Proxy to backend with restricted access
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://dbgpt_backend;
}