Description

DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory. skill_upload in packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py takes file.filename as given and writes the request body to upload_dir / filename. A path composed with that operator discards the left operand when the right one is absolute and follows parent references otherwise, so a filename such as ../../../tmp/x or /tmp/x resolves outside the intended directory; nothing canonicalises the result, checks that it remains under the upload root, or prevents a .py suffix. The route's only dependency is get_user_from_headers in dbgpt_serve/utils/auth.py, which returns a request carrying the admin role whether or not a user_id header is supplied, so the endpoint is reachable without credentials. A remote attacker holding no account can therefore write attacker-controlled bytes to any path the server process can write, place a new Python module inside the application package or replace one the application already imports, and obtain code execution in the server process when that module is next imported.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-25T21:18:24.163Z",
  "pubdate": "2026-08-25T21:18:24.163Z",
  "executiveSummary": "An arbitrary file write vulnerability exists within the DB-GPT application, specifically in the skill_upload function. This vulnerability stems from improper path validation when processing file uploads, allowing an attacker to traverse outside the intended upload directory.\nBy manipulating the multipart filename parameter, an unauthenticated attacker can perform a path traversal attack to write arbitrary files to any location accessible by the server process. This includes the ability to overwrite existing application code or inject new Python modules into the environment.\nThe vulnerability is compounded by a flawed authentication mechanism in get_user_from_headers, which grants administrative privileges to requests regardless of the presence or validity of a user_id header.\nThe impact of this vulnerability is critical, as it allows for arbitrary code execution (RCE) on the underlying server. Successful exploitation leads to full system compromise, data exfiltration, and unauthorized access to application resources. No authentication is required to reach the vulnerable endpoint, posing a significant risk to any exposed DB-GPT installation.",
  "technicalDetails": "The root cause of this vulnerability is an insecure implementation of path construction in the skill_upload function located at packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py. The application accepts a multipart file upload and utilizes the user-supplied file.filename to define the destination path by joining it with the intended upload_dir using an operator that fails to sanitize or constrain the resulting path.\nIn Python, when using the / operator (or similar path concatenation methods) with pathlib, an absolute path provided in the second operand will discard the base directory entirely. Furthermore, the application fails to perform canonicalization or validation on the resulting path, allowing the use of parent directory references such as '../' to escape the designated storage directory.\nThe attack flow proceeds as follows: An attacker sends a crafted POST request to the file upload endpoint. The multipart/form-data payload contains a filename field set to a malicious path, such as '../../../../app/module.py' or an absolute path like '/tmp/malicious.py'. Because the application does not validate the integrity of this path, the server writes the uploaded binary content—containing attacker-defined Python code—directly to the specified filesystem destination.\nThe vulnerability is further exacerbated by the authentication implementation in dbgpt_serve/utils/auth.py. The get_user_from_headers function returns an object with administrative privileges regardless of whether a legitimate user_id is provided, effectively rendering the endpoint public and unprotected by any meaningful access control. This allows an unauthenticated, remote attacker to interact with the vulnerable API without providing credentials.\nPost-exploitation, the attacker can leverage the ability to write files to the server's filesystem to achieve Remote Code Execution. By placing a malicious Python script within the application's import path or overwriting an existing module that the application regularly imports, the attacker ensures their code is executed by the server process. Once the application loads the malicious module, the injected payload runs with the privileges of the DB-GPT service, leading to total compromise of the application context and potentially the host environment."
}