DB-GPT CVE-2026-51862

Exploitation requires network access to the DB-GPT skill_upload API endpoint (agentic_data_api) in version 0.8.0 and the ability to submit an upload whose destination path is attacker-controlled; the traversal occurs because the filename/path is not sanitized before being joined to the storage directory. The supplied CVSS vector marks PR:N (no authentication), but whether the upload endpoint is exposed without authentication depends on how the DB-GPT instance is deployed and network-exposed - this is the primary real-world limiting factor and should be confirmed per deployment. No special non-default feature toggle is indicated by the description; the bug is in the upload handler's path handling itself.

Signals are moderately conflicting and should be read together. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, base 9.1) describes a remote, low-complexity, unauthenticated flaw with high confidentiality and integrity impact. However, the underlying weakness is a directory-traversal file-WRITE in the skill_upload endpoint, which structurally produces integrity (and potentially availability) impact rather than confidentiality - the C:H assignment is questionable and likely inflates the base score; verify impact semantics with the researcher/vendor. Counterbalancing the high CVSS, EPSS is low at 0.47% (38th percentile), indicating low modeled near-term mass-exploitation probability, and the CVE is NOT in CISA KEV, so there is no confirmed active exploitation. A referenced public gist (Ro1ME) appears to document the exploitation path, so publicly available exploit material likely exists, but POC existence is not the same as active exploitation. Net: this is a genuinely serious bug for anyone running DB-GPT 0.8.0 with the upload endpoint reachable (arbitrary file write can escalate to code execution), but the real-world priority is tempered by the product's limited production footprint and low EPSS - treat it as high-priority for the specific population running DB-GPT, not an internet-wide emergency.

An attacker who can reach the DB-GPT skill_upload API endpoint submits an upload whose path/filename contains traversal sequences (e.g. ../../), causing a file to be written outside the intended workspace or storage directory. By overwriting a configuration file, startup script, or web-served asset, the attacker can pivot from arbitrary file write to remote code execution or service compromise. A public gist referenced in the advisory appears to document the exploitation path, lowering the bar for reproduction.