Dbgpt version 0.6.0 and earlier are vulnerable to an absolute path traversal in the knowledge document upload API. This flaw allows attackers to write arbitrary files to any location on the server by manipulating the filename parameter. The vulnerability is fixed in version 0.6.2.