CVE-2025-51459

n/a / n/a PUBLISHED

Description (CNA)

File Upload vulnerability in agent.hub.controller.refresh_plugins in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary code via a malicious plugin ZIP file uploaded to the /v1/personal/agent/upload endpoint, interacting with plugin_hub._sanitize_filename and plugins_util.scan_plugins.

Affected (CNA)

Vendor / product	Versions
n/a / n/a	affected n/a

CWE

No CWE identifiers supplied.

References

https://github.com/eosphoros-ai/DB-GPT/pull/2649
https://www.gecko.security/blog/cve-2025-51459

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.