CVE-2026-4505 | eosphoros-ai DB-GPT up to 0.7.5 FastAPI Endpoint controller.py module_plugin.refresh_plugins unrestricted upload

A vulnerability described as critical has been identified in eosphoros-ai DB-GPT up to 0.7.5. This issue affects the function module_plugin.refresh_plugins of the file packages/dbgpt-serve/src/dbgpt_serve/agent/hub/controller.py of the component FastAPI Endpoint. Such manipulation leads to unrestricted upload.

This vulnerability is referenced as CVE-2026-4505. It is possible to launch the attack remotely. Furthermore, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.