CVE-2026-51864 in DB-GPT
Summary
by MITRE • 10/01/2026
DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py:42). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in DB-GPT versions 0.7.5 and 0.8.0 represents a critical directory traversal flaw located within the python_file_upload functionality, specifically at line forty-two of the file packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py. This component is responsible for handling incoming Python script uploads via an OpenAPI interface, which is commonly used to facilitate automated data processing or model inference tasks in large language model applications. The core technical flaw stems from insufficient validation of the file path provided by the client during the upload process. Instead of strictly sanitizing the input to ensure it remains within a predefined safe directory structure, the application accepts relative paths that include parent directory traversal sequences such as dot-dot-slash. This allows an attacker to manipulate the destination filename and write files to arbitrary locations on the server's file system outside the intended workspace or storage boundary designated for user uploads.
From a technical perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The application fails to enforce strict path canonicalization before writing the uploaded content. When a remote attacker submits a request containing maliciously crafted file paths, the underlying operating system resolves these relative references against the current working directory or the base upload folder. By utilizing traversal sequences, the attacker can navigate up the directory tree and place files in sensitive areas such as application configuration directories, web root folders for public access, or even system-level directories if the service is running with elevated privileges. This lack of input validation effectively bypasses the intended isolation mechanisms that separate user-generated content from critical application assets.
The operational impact of this vulnerability is severe due to its potential for remote code execution and unauthorized data manipulation. An attacker who successfully exploits this directory traversal can upload a malicious Python script or web shell to a location where it can be executed by the server process or accessed via a web interface. If the uploaded file lands in an executable path, the attacker gains full control over the underlying host system, potentially leading to complete compromise of the DB-GPT instance and any connected data sources. Furthermore, if the upload directory is publicly accessible, the attacker could serve malicious content directly through HTTP requests, facilitating drive-by download attacks against users interacting with the application. This also poses a significant risk of denial of service by overwriting critical system files or filling up disk space in unintended locations.
This vulnerability maps to several entries within the MITRE ATT&CK framework, particularly T1505: Server Software Component and T1105: Ingress Tool Transfer. The exploitation involves transferring unauthorized tools into a trusted environment (the server) via a legitimate upload mechanism that has been subverted through path manipulation. Additionally, it relates to T1204: User Execution if the uploaded file is designed to be triggered by another user or process within the system. The ability to write outside restricted boundaries also touches upon privilege escalation vectors depending on how the application subsequently processes these files.
Mitigation strategies must focus on strict input validation and secure path handling practices. Developers should implement absolute path resolution for all upload destinations, ensuring that the final resolved path always starts with the expected base directory prefix. It is essential to reject any request where the canonicalized file path does not match this allowed root. Additionally, implementing allowlists for permitted file extensions can prevent the execution of malicious scripts even if they are written to a valid location. Applying principle of least privilege by running the application service under a restricted user account with minimal filesystem permissions further limits the blast radius in case an exploit is successful. Regular security audits and static code analysis focused on path traversal vulnerabilities should be integrated into the development lifecycle to prevent similar issues from arising in future versions.