DB-GPT CVE-2026-73034

The DB-GPT Python file-upload endpoint (python_upload_api) must be reachable by the attacker and, in v0.8.1, accepts a client-supplied user_id HTTP header that is used unsanitized as an upload path component. The concrete prerequisite is the ability to send a multipart upload request with a user_id header containing traversal sequences (../ or path separators); no credentials, tokens, or user interaction are needed (PR:N/UI:N). To convert the arbitrary write into code execution, the attacker must target a path the host will later execute (Python startup hook, cron directory, or agent script) and the service account must have write permission to that path - this write-target dependency and the network-exposure of the endpoint are the main practical limiters, along with DB-GPT's relatively narrow deployment base.

This is a genuine high-priority issue, not a high-CVSS-but-low-impact paper cut. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H, score 9.3) aligns fully with the description: network-reachable, low complexity, no authentication, no user interaction, and full confidentiality/integrity/availability impact via the RCE that arbitrary file write enables. The vulnerability was reported by VulnCheck (disclosure@vulncheck.com) with a dedicated advisory, which raises confidence in its reality. No CISA KEV listing and no EPSS score were provided, and no public exploit is identified at time of analysis - so there is no evidence of active mass exploitation yet, but the combination of unauthenticated write-to-RCE and a public patch commit that clearly reveals the vulnerable code path makes reverse-engineering into a working exploit straightforward; any organization running DB-GPT v0.8.1 on a network-accessible interface should treat this as urgent and patch immediately rather than waiting for exploitation to be observed. The primary limiting factor is deployment footprint (DB-GPT is a niche AI framework, not ubiquitous enterprise software), which likely means targeted rather than internet-wide exploitation.

An attacker who can reach the DB-GPT HTTP interface sends a crafted multipart file-upload request to the Python upload endpoint with a user_id header like '../../../../etc/cron.d' (or a path to a Python startup hook or agent script directory) and an attacker-controlled file body. The malicious file lands outside python_uploads in a location that is later executed, yielding remote code execution as the DB-GPT service account. No authentication or user interaction is required (AV:N/AC:L/PR:N/UI:N), so exploitation is a single unauthenticated request; no public POC is identified yet, but the patch commit exposes the exact injection point.