Dbgpt version 0.6.0 and earlier contains a vulnerability in its web API endpoint POST /v1/personal/agent/upload that allows unauthorized attackers to upload arbitrary files with path traversal. This can lead to placing malicious files anywhere on the victim's file system, including critical locations such as Python's site-packages directory, enabling remote code execution.