A missing path constraint in DB-GPT's skill upload endpoint lets an unauthenticated remote attacker write arbitrary files to the server filesystem and gain code execution in the application process.
What Is It
DB-GPT builds the destination path for an uploaded skill directly from the multipart filename. The skill_upload handler in packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py takes file.filename as given and writes the request body to upload_dir / filename. Because that path operator discards the left operand when the right one is absolute and otherwise follows parent references, a filename such as ../../../tmp/x or /tmp/x resolves outside the intended directory. Nothing canonicalises the result, verifies it stays under the upload root, or blocks a .py suffix.
The route's only dependency is get_user_from_headers in dbgpt_serve/utils/auth.py, which returns a request carrying the admin role whether or not a user_id header is supplied; so the endpoint is reachable with no credentials at all. The issue is tracked as CWE-22 (path traversal), rated CVSS 3.1 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CVSS 4.0 9.3 CRITICAL.
Why It Matters
An attacker with no account can write attacker-controlled bytes to any path the server process can write. That includes dropping a new Python module inside the application package or replacing one the application already imports; yielding code execution in the server process the next time that module is imported. Network-reachable, no privileges, no user interaction, no exploit prerequisites.
There is no CISA KEV entry for this CVE, so active exploitation is not confirmed at this time.
What's Vulnerable
- Vendor/product: eosphoros-ai DB-GPT
- Package:
pkg:pypi/dbgpt-app - Affected: version 0.8.0 (all versions
>= 0.8.0, < 0.8.1) - Fixed in: 0.8.1
Patch Status
Upgrade to DB-GPT v0.8.1. No mitigation or required-action guidance beyond the vendor release is present in the supplied source data. CVE record status is "Received," published 2026-08-25 by VulnCheck.