CVE-2026-80104
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory. The skill_upload function does not canonicalize the path or check that it remains under the upload root, allowing writes outside it. The endpoint is reachable without authentication, enabling a remote attacker to write arbitrary files and achieve code execution.
Risk Assessment
An unauthenticated attacker can write malicious files anywhere on the filesystem, potentially leading to code execution in the server process and full application compromise.
Recommendation
Update DB-GPT to a patched version. Additionally, restrict access to the upload endpoint and require authentication for all file upload operations.
Other vulnerabilities in DB-GPT
See all- CVE-2026-51869Critical
DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host.
- CVE-2026-51866Critical
In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow. This allows a previously uploaded, potentially malicious skill to be run in the agent context.
- CVE-2026-51864Critical
DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py:42). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary.
- CVE-2026-51862Critical
DB-GPT 0.8.0 contains directory traversal in skill_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py:40). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary.
- CVE-2026-73034Critical
DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the user_id HTTP header of the Python file-upload endpoint. Attackers can send a crafted multipart upload request with a traversal-poisoned user_id header to escape the intended upload directory and write attacker-controlled content to locations such as Python startup hooks, cron directories, or agent scripts, resulting in remote code execution.
Original NVD description (English source)
DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory. skill_upload in packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py takes file.filename as given and writes the request body to upload_dir / filename. A path composed with that operator discards the left operand when the right one is absolute and follows parent references otherwise, so a filename such as ../../../tmp/x or /tmp/x resolves outside the intended directory; nothing canonicalises the result, checks that it remains under the upload root, or prevents a .py suffix. The route's only dependency is get_user_from_headers in dbgpt_serve/utils/auth.py, which returns a request carrying the admin role whether or not a user_id header is supplied, so the endpoint is reachable without credentials. A remote attacker holding no account can therefore write attacker-controlled bytes to any path the server process can write, place a new Python module inside the application package or replace one the application already imports, and obtain code execution in the server process when that module is next imported.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS