CVE-2026-51863: Security vulnerability

Published Oct 29, 2026

Updated

DB-GPT v0.7.5 and 0.8.0 contains directory traversal in useexamplefile (packages/dbgpt-app/src/dbgptapp/openapi/apiv1/examplesapi.py:129). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary.

Event History

Oct 29, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·06:17 PM

Description

Frequently Asked Questions

Which DB-GPT versions are identified as affected?

The reported affected versions are DB-GPT v0.7.5 and 0.8.0.

What access does an attacker need to exploit this issue?

The issue is described as remotely exploitable through the use_example_file path. The provided data does not state any authentication or privilege requirement.

What is the potential impact of successful exploitation?

An attacker can write files outside the intended workspace or storage boundary, which may allow unauthorized modification of files reachable by the DB-GPT process.

CVE-2026-51863: Security vulnerability

Event History

Frequently Asked Questions

Which DB-GPT versions are identified as affected?

What access does an attacker need to exploit this issue?

What is the potential impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which DB-GPT versions are identified as affected?

What access does an attacker need to exploit this issue?

What is the potential impact of successful exploitation?