CVE-2026-80104
CriticalCVSS 9.8Summary
DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory. The skill_upload function does not canonicalize the path or check that it remains under the upload root, allowing writes outside it. The endpoint is reachable without authentication, enabling a remote attacker to write arbitrary files and achieve code execution.
Risk Assessment
An unauthenticated attacker can write malicious files anywhere on the filesystem, potentially leading to code execution in the server process and full application compromise.
Recommendation
Update DB-GPT to a patched version. Additionally, restrict access to the upload endpoint and require authentication for all file upload operations.
Original NVD description (English source)
DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory. skill_upload in packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py takes file.filename as given and writes the request body to upload_dir / filename. A path composed with that operator discards the left operand when the right one is absolute and follows parent references otherwise, so a filename such as ../../../tmp/x or /tmp/x resolves outside the intended directory; nothing canonicalises the result, checks that it remains under the upload root, or prevents a .py suffix. The route's only dependency is get_user_from_headers in dbgpt_serve/utils/auth.py, which returns a request carrying the admin role whether or not a user_id header is supplied, so the endpoint is reachable without credentials. A remote attacker holding no account can therefore write attacker-controlled bytes to any path the server process can write, place a new Python module inside the application package or replace one the application already imports, and obtain code execution in the server process when that module is next imported.