CVE-2026-73034
CriticalCVSS 9.8Summary
DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the user_id HTTP header of the Python file-upload endpoint. Attackers can send a crafted multipart upload request with a traversal-poisoned user_id header to escape the intended upload directory and write attacker-controlled content to locations such as Python startup hooks, cron directories, or agent scripts, resulting in remote code execution.
Risk Assessment
The risk to the organization includes full server compromise, as an attacker can execute arbitrary code in the application context, potentially leading to data theft, system modification, and further attacks.
Recommendation
It is recommended to immediately update DB-GPT to a patched version and to validate and sanitize HTTP headers, especially user_id, before using them in file operations.
Original NVD description (English source)
DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the user_id HTTP header of the Python file-upload endpoint. Attackers can send a crafted multipart upload request with a traversal-poisoned user_id header to escape the intended upload directory and write attacker-controlled content to locations such as Python startup hooks, cron directories, or agent scripts, resulting in remote code execution.