CVE-2026-51862: DB-GPT DB-GPT vulnerability

Published Sep 30, 2026

Updated

DB-GPT 0.8.0 contains directory traversal in skillupload (packages/dbgpt-app/src/dbgptapp/openapi/apiv1/agenticdataapi.py:40). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary.

Affected Software

1 affected component

DB-GPT DB-GPT=0.8.0

Event History

Sep 30, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·09:17 PM

Description

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The issue is remotely exploitable through the skill_upload functionality. The provided data does not state whether authentication or specific privileges are required.

What is the impact of successful exploitation?

An attacker can write files outside the intended workspace or storage boundary by exploiting directory traversal in skill_upload. The provided data does not specify which filesystem locations are writable or whether this can lead to code execution.

Which DB-GPT version is identified as affected?

The affected version identified in the provided data is DB-GPT 0.8.0.

CVE-2026-51862: DB-GPT DB-GPT vulnerability

Affected Software

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the impact of successful exploitation?

Which DB-GPT version is identified as affected?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the impact of successful exploitation?

Which DB-GPT version is identified as affected?