CVE-2026-80104: DB-GPT 0.8.0 Path Traversal Arbitrary File Write via Skill Upload Filename
DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory. skillupload in packages/dbgpt-app/src/dbgptapp/openapi/apiv1/agenticdataapi.py takes file.filename as given and writes the request body to uploaddir / filename. A path composed with that operator discards the left operand when the right one is absolute and follows parent references otherwise, so a filename such as ../../../tmp/x or /tmp/x resolves outside the intended directory; nothing canonicalises the result, checks that it remains under the upload root, or prevents a .py suffix. The route's only dependency is getuserfromheaders in dbgptserve/utils/auth.py, which returns a request carrying the admin role whether or not a userid header is supplied, so the endpoint is reachable without credentials. A remote attacker holding no account can therefore write attacker-controlled bytes to any path the server process can write, place a new Python module inside the application package or replace one the application already imports, and obtain code execution in the server process when that module is next imported.
Affected Software
Event History
Frequently Asked Questions
Who can exploit the affected upload endpoint?
A remote, unauthenticated attacker can reach it without an account. The route's header-based user dependency returns an admin-role request even when no user_id header is supplied.
What access or conditions are needed for code execution?
The attacker needs network access to the endpoint and the ability to submit a crafted multipart filename. They can write only to paths writable by the DB-GPT server process; code execution can occur when a placed or replaced Python module is subsequently imported.
Are default deployments affected?
The described route does not require credentials because of its user-header dependency behavior, so deployments exposing this endpoint are affected without needing a special authentication configuration.
What can be done if updating is not immediately possible?
Restrict network access to the skill upload endpoint so untrusted remote users cannot submit multipart uploads. Also run the DB-GPT server process with minimal filesystem write permissions to limit where an attacker could write files.
How can defenders look for exploitation attempts?
Review skill-upload requests for filenames containing parent-directory references such as ../../../ or absolute paths such as /tmp/x. Inspect writable application-package paths and other locations writable by the server process for unexpected Python files or modified modules.