EUVD-2026-90417
GHSA-wmgw-w39q-pxgw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach DB-GPT upload API over network
-
DeliverySend upload with ../ traversal in filename
-
ExploitServer writes file outside workspace boundary
-
ExecutionOverwrite config or executable path
-
ImpactAchieve code execution or service compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that the DB-GPT instance (v0.7.5 or v0.8.0) exposes its OpenAPI v1 python_file_upload endpoint (python_upload_api.py) to the attacker; DB-GPT ships its API without enforced authentication by default, which is why the vector is PR:N. Exploitation therefore hinges on network reachability of the DB-GPT web service rather than on any special feature toggle. Limiting factors: only these two versions are named, the service must be network-accessible to the attacker (internal-only deployments behind auth proxies are largely insulated), and realized impact depends on filesystem permissions of the service account and whether a traversal target maps to a sensitive code/config path. |
| Impact | Signals are mostly aligned toward a genuine but not yet mass-exploited issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, unauthenticated, low-complexity flaw rated 9.1, consistent with a CWE-22 path traversal in an HTTP file-upload endpoint. However, EPSS is low at 0.47% (38th percentile), and there is NO CISA KEV listing, so there is no evidence of active or widespread exploitation at this time. A public gist (Ro1ME) and a GitHub issue are referenced, indicating that exploit/proof-of-concept material very likely exists publicly, which typically precedes opportunistic scanning. There is a notable signal conflict worth flagging: the official vector sets C:H and I:H, but the described primitive is a directory-traversal FILE WRITE outside the workspace, which maps most directly to integrity (and potentially availability via overwrite) rather than confidentiality - the C:H rating is not well justified by the description and should be verified with the vendor/reporter. Net: a real, high-priority flaw for anyone actually running DB-GPT exposed to untrusted networks, but low real-world urgency for the general population given the niche product footprint and low EPSS. |
| Exploit ScenarioDerived | A remote attacker sends a crafted file-upload request to DB-GPT's python_file_upload OpenAPI endpoint with a traversal sequence (e.g. ../../) in the filename, causing the server to write attacker-controlled content outside the intended workspace. Because such a write can land in a code, configuration, or startup path, it can escalate from arbitrary file write toward code execution. Publicly referenced proof-of-concept material (a gist and the upstream GitHub issue) appears to exist, lowering the barrier to reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Path traversal in DB-GPT 0.7.5 and 0.8.0 lets remote attackers write arbitrary files outside the intended upload workspace through the OpenAPI python_file_upload endpoint at packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py:42. The affected service is the DB-GPT web API and the vector is rated critical (CVSS 9.1, AV:N/AC:L/PR:N/UI:N), so exploitation hinges on network reachability of the instance rather than on any attacker-held credentials - DB-GPT ships its API without enforced authentication by default, which is why the score is PR:N. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis; EPSS is low at 0.47% (38th percentile), so this is a genuine but not yet mass-exploited issue. Note a scoring divergence: NVD rates confidentiality and integrity high with no availability impact, while our independent assessment rates integrity and availability high and confidentiality none.
RemediationAI
No vendor-released patch was identified at time of analysis, and no exact fixed version can be cited from the available data; the upstream issue at https://github.com/eosphoros-ai/DB-GPT/issues/3027 should be tracked for an official fix, and upgrading should occur only to a release the maintainers explicitly identify as patched. Until then, apply compensating controls that target the traversal and the default-open API surface: do not expose the DB-GPT web service directly to untrusted networks (bind it to localhost or a private segment, or place it behind an authenticating reverse proxy, since the API ships without enforced authentication - the trade-off is added operational complexity and possible breakage of internal integrations that call the API unauthenticated); block or disable the python_file_upload route under the OpenAPI v1 namespace at the proxy/WAF layer if the Python upload feature is not actively used (side effect: legitimate feature functionality is lost). Constrain the impact of any successful traversal by running DB-GPT under a dedicated low-privilege account with a read-only root filesystem in a container, mounting only a single dedicated upload directory as writable, and applying an AppArmor/SELinux profile that prevents writes to application code and configuration paths (trade-off: application writes outside the upload directory, such as logs or caches, must be explicitly allowed or redirected). Note that EPSS is low (0.47%) and no public exploit has been identified, so these hardening steps can be prioritized against other exposure, but the unauthenticated nature of the endpoint argues against leaving it internet-reachable.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. path traversal) is the root cause here. DB-GPT is an open-source LLM/agent application framework from eosphoros-ai that exposes a FastAPI-based OpenAPI v1 surface; the python file upload handler is intended to receive user-supplied Python files into a sandboxed or designated workspace, but the filename/target path in the request is not adequately sanitized or canonicalized before being joined to the storage root. Because traversal sequences (e.g. ../) survive into the write path, a caller can redirect the write outside the intended workspace or storage boundary, landing content in arbitrary locations writable by the service account - including application source, configuration, or startup-loaded Python modules, which is what drives the high integrity and availability potential. The provided CPE string is a placeholder (cpe:2.3:a:n/a:n/a) so no structured product/version mapping is available from that source; the version scope comes from the description and EUVD, which name only v0.7.5 and v0.8.0. Mitigating factors: only those two versions are implicated, the endpoint must be network-reachable, and realized impact depends on the filesystem permissions of the DB-GPT service account and on whether a traversal target happens to map to a sensitive code or configuration path.
Know when Db Gpt gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network-reachable upload (AV:N/PR:N/AC:L) yields an arbitrary file-write primitive, so I:H and overwrite-driven A:H; no direct read path, so C:N.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py:42). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary.
Executive ViewAI
DB-GPT versions 0.7.5 and 0.8.0 ship with an unauthenticated file-upload flaw that allows anyone able to reach the web API to write files to arbitrary locations on the host, which in practice can lead to full compromise of the server running the platform. Because the API has no enforced authentication by default, any DB-GPT instance exposed to a network - including internal corporate networks - is reachable without attacker-held credentials. Leadership should care because these deployments typically hold proprietary data, model artifacts, and cloud credentials whose loss or tampering would be difficult to detect and expensive to remediate.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce authentication and network-level access control in front of the DB-GPT web API, restrict or disable the python_file_upload endpoint, run the service as a non-privileged user in a container with a read-only filesystem and no host mounts, deploy WAF rules blocking path-traversal payloads on upload paths, and monitor file integrity on upload and web-served directories.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /v1/personal/agent/upload` is vulnerable to Arbitrary File Uplo
In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /api/v1/editor/sql/run` allows execution of arbitrary SQL queri
eosphoros-ai/db-gpt version 0.6.0 is vulnerable to an arbitrary file write through the knowledge API. Rated critical sev
In eosphoros-ai/db-gpt version 0.6.0, the endpoint for uploading files is vulnerable to absolute path traversal. Rated c
eosphoros-ai/db-gpt version 0.6.0 contains a vulnerability in the RAG-knowledge endpoint that allows for arbitrary file
A Path Traversal vulnerability exists in the eosphoros-ai/db-gpt version 0.6.0 at the API endpoint `/v1/resource/file/de
eosphoros-ai/DB-GPT version latest is vulnerable to arbitrary file deletion on Windows systems via the '/v1/agent/hub/up
In version 0.6.0 of eosphoros-ai/db-gpt, the `uvicorn` app created by `dbgpt_server` uses an overly permissive instance
Path traversal in DB-GPT versions 0.7.0 through 0.7.2 allows unauthenticated remote attackers to read or write files out
SQL injection in eosphoros-ai db-gpt versions up to 0.7.5 allows unauthenticated remote attackers to manipulate the /api
Unauthenticated arbitrary file write in DB-GPT 0.8.0 lets remote attackers achieve remote code execution through the ski
An unrestricted file upload vulnerability exists in eosphoros-ai DB-GPT versions up to 0.7.5 within the module_plugin.re
Exploit-DB