CVE-2026-3409

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

A security flaw has been discovered in eosphoros-ai db-gpt 0.7.5. Affected is the function importlib.machinery.SourceFileLoader.exec_module of the file /api/v1/serve/awel/flow/import of the component Flow Import Endpoint. Performing a manipulation as part of File results in code injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Mar 2, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-340907.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation CheckUser. This issue affects CheckUser: fCVE-2026-340917.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: fCVE-2026-340927.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associatCVE-2026-340935.3Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associatCVE-2026-340943.8Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Page/Article.Php. This isCVE-2026-340956.1Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Actions/ActionEntryPoint.PhpCVE-2026-340964.6Guardian language-system fails to sanitize the name GET parameter before outputting it into an HTML input value attribute in designer.php (lCVE-2026-340974.6Guardian language-system fails to sanitize the id GET parameter before inserting it into multiple HTML form action attributes in text_file.pCVE-2026-340984.6Guardian language-system fails to sanitize the id GET parameter before inserting it into HTML source and form action attributes in media.phpCVE-2026-340999.8Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in job_info.php (line 16): SELECT * FROM jobs whCVE-2026-34109.8A weakness has been identified in itsourcecode Society Management System 1.0. Affected by this vulnerability is an unknown functionality of CVE-2026-341008.8Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in media.php (line 17): SELECT id, filename, ext