CVE-2026-73034
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk93th percentile - higher than 93% of all known CVEs
Summary
DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the user_id HTTP header of the Python file-upload endpoint. Attackers can send a crafted multipart upload request with a traversal-poisoned user_id header to escape the intended upload directory and write attacker-controlled content to locations such as Python startup hooks, cron directories, or agent scripts, resulting in remote code execution.
Risk Assessment
The risk to the organization includes full server compromise, as an attacker can execute arbitrary code in the application context, potentially leading to data theft, system modification, and further attacks.
Recommendation
It is recommended to immediately update DB-GPT to a patched version and to validate and sanitize HTTP headers, especially user_id, before using them in file operations.
Other vulnerabilities in DB-GPT
See all- CVE-2026-51863Critical
DB-GPT v0.7.5 and 0.8.0 contains directory traversal in use_example_file (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/examples_api.py:129). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary.
- CVE-2026-77933Critical
DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database access including FILE and SUPER privileges.
- CVE-2026-77932Critical
DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock get_user_from_headers function that grants every caller the admin role. Unauthenticated attackers can send prompts that make the ReAct agent's unsandboxed code_interpreter and shell_interpreter tools run arbitrary Python or bash as root in the webserver container, including reaching the bundled database with default credentials.
- CVE-2026-51869Critical
DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host.
- CVE-2026-51866Critical
In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow. This allows a previously uploaded, potentially malicious skill to be run in the agent context.
- CVE-2026-51864Critical
DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py:42). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary.
- CVE-2026-51862Critical
DB-GPT 0.8.0 contains directory traversal in skill_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py:40). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary.
- CVE-2026-80104Critical
DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory. The skill_upload function does not canonicalize the path or check that it remains under the upload root, allowing writes outside it. The endpoint is reachable without authentication, enabling a remote attacker to write arbitrary files and achieve code execution.
Original NVD description (English source)
DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the user_id HTTP header of the Python file-upload endpoint. Attackers can send a crafted multipart upload request with a traversal-poisoned user_id header to escape the intended upload directory and write attacker-controlled content to locations such as Python startup hooks, cron directories, or agent scripts, resulting in remote code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS