Description

DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the user_id HTTP header of the Python file-upload endpoint. Attackers can send a crafted multipart upload request with a traversal-poisoned user_id header to escape the intended upload directory and write attacker-controlled content to locations such as Python startup hooks, cron directories, or agent scripts, resulting in remote code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-11T20:18:46.470Z",
  "pubdate": "2026-08-11T20:18:46.470Z",
  "executiveSummary": "DB-GPT version v0.8.1 contains a critical unauthenticated path traversal vulnerability within its file-upload endpoint. The flaw enables remote attackers to execute arbitrary file write operations across the underlying server filesystem by injecting directory traversal sequences directly into the user_id HTTP header. Successful exploitation requires network access to the vulnerable endpoint without prior authentication. By manipulating the destination path during a multipart file upload request, an attacker can bypass intended directory restrictions and overwrite critical system files. The resulting impact includes remote code execution through the placement of malicious payloads into sensitive locations such as Python startup hooks, cron directories, or agent execution scripts, posing severe risk implications to confidentiality, integrity, and availability of the affected system.",
  "technicalDetails": "The vulnerability resides in the Python file-upload endpoint of DB-GPT v0.8.1, specifically within how input derived from the user_id HTTP header is processed and utilized in file system path construction. The root cause is an insufficient sanitization and validation mechanism for user-supplied header data prior to passing it into file write operations. Because the application blindly trusts or inadequately filters the user_id parameter, an attacker can inject directory traversal sequences (such as ../) to escape the intended upload directory containment boundaries.\nExploitation is achieved by sending a crafted HTTP multipart upload request to the file-upload endpoint over the network. The attacker supplies malicious directory traversal payloads within the user_id HTTP header alongside an attacker-controlled file payload. As the application processes the upload, it concatenates the unsanitized user_id value with the base storage path, causing the file write routine to resolve to arbitrary absolute or relative paths outside the designated workspace.\nThe attack flow proceeds as follows: 1) The unauthenticated attacker formulates a malicious multipart HTTP request targeting the DB-GPT file-upload endpoint. 2) The attacker injects traversal strings into the user_id header. 3) The application parses the request and evaluates the destination path, allowing the traversal sequences to traverse upward in the directory tree. 4) The server writes the attacker-controlled file content to the targeted arbitrary location on the filesystem.\nThe vulnerable component is exposed over the network, requires no authentication, and can be exploited by remote threat actors with zero prior privileges. Post-exploitation impact is catastrophic, as the capability to write arbitrary files enables attackers to deposit payloads into strategic system locations. These include Python startup hooks, cron job directories, or system agent scripts. Subsequent execution of these modified or planted files by the system or underlying services culminates in full remote code execution under the privileges of the DB-GPT process."
}