CVE-2026-4505: eosphoros-ai DB-GPT RCE Vulnerability

CVE-2026-4505 Overview

A vulnerability has been identified in eosphoros-ai DB-GPT up to version 0.7.5 that allows unrestricted file upload through the FastAPI endpoint. The vulnerability exists in the module_plugin.refresh_plugins function located in packages/dbgpt-serve/src/dbgpt_serve/agent/hub/controller.py. This improper access control flaw enables authenticated remote attackers to upload arbitrary files to the server without proper validation, potentially leading to remote code execution.

Critical Impact

Authenticated attackers can exploit this unrestricted file upload vulnerability remotely to upload malicious files, potentially achieving code execution on the target system. The exploit has been publicly disclosed and the vendor has not responded to disclosure attempts.

Affected Products

• eosphoros-ai DB-GPT versions up to 0.7.5
• DB-GPT FastAPI Endpoint component
• DB-GPT Agent Hub Controller module

Discovery Timeline

• 2026-03-20 - CVE-2026-4505 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-4505

Vulnerability Analysis

This vulnerability stems from improper access control (CWE-284) in the DB-GPT plugin refresh functionality. The module_plugin.refresh_plugins function within the FastAPI endpoint fails to properly validate and restrict file uploads, allowing attackers to bypass intended security controls. The vulnerability is accessible over the network, requires low privileges to exploit, and does not require user interaction, making it relatively straightforward to attack.

The affected component processes plugin uploads through the agent hub controller without adequately verifying the content type, file extension, or destination path of uploaded files. This creates a pathway for attackers to upload malicious content such as web shells, reverse shell scripts, or other executable payloads.

Root Cause

The root cause of this vulnerability is improper access control in the file upload handling mechanism within the controller.py file of the DB-GPT agent hub. The module_plugin.refresh_plugins function does not implement sufficient validation checks on incoming file uploads, allowing files of any type to be uploaded and potentially stored in accessible locations on the server.

Key contributing factors include:

• Missing file type validation
• Absence of content-type verification
• Inadequate path sanitization
• Lack of file extension restrictions

Attack Vector

The attack is conducted remotely over the network against the FastAPI endpoint. An authenticated attacker with low-privilege access can craft malicious HTTP requests to the refresh_plugins endpoint, uploading arbitrary files to the server. The exploit has been publicly disclosed through a GitHub PoC Repository.

The attack flow typically involves:

1. Authenticating to the DB-GPT application with valid credentials
2. Sending a crafted HTTP request to the vulnerable refresh_plugins endpoint
3. Including a malicious file payload (such as a Python web shell) in the upload request
4. The server accepts and stores the file without proper validation
5. The attacker accesses the uploaded file to execute arbitrary code

For technical details on the exploitation method, refer to the VulDB entry #352071.

Detection Methods for CVE-2026-4505

Indicators of Compromise

• Unexpected files appearing in plugin directories or upload paths within DB-GPT installations
• Unusual HTTP POST requests to the /api/v1/agent/hub/refresh or similar plugin refresh endpoints
• Web server logs showing file upload activity with unusual file extensions (.py, .sh, .php)
• New or modified files in packages/dbgpt-serve/src/dbgpt_serve/agent/hub/ directory

Detection Strategies

• Monitor HTTP traffic for POST requests targeting the agent hub controller endpoints with file upload payloads
• Implement file integrity monitoring on DB-GPT installation directories to detect unauthorized file additions
• Review web application firewall (WAF) logs for attempts to upload executable file types
• Audit authentication logs for accounts accessing plugin management functionality

Monitoring Recommendations

• Enable detailed logging for the FastAPI application, particularly for the agent hub controller endpoints
• Configure alerts for file creation events in plugin directories with executable extensions
• Deploy network intrusion detection signatures to identify malicious upload attempts
• Implement real-time monitoring of web server access logs for suspicious POST activity to plugin endpoints

How to Mitigate CVE-2026-4505

Immediate Actions Required

• Restrict network access to DB-GPT instances using firewall rules or network segmentation
• Disable or restrict access to the refresh_plugins functionality if not required
• Review and audit all files in plugin directories for unauthorized or suspicious content
• Implement additional authentication controls for plugin management functions
• Consider taking affected instances offline until a patch is available

Patch Information

At the time of this advisory, the vendor (eosphoros-ai) has not responded to disclosure attempts and no official patch is available. Organizations should implement the workarounds listed below and monitor for vendor security advisories. Additional information may be available through VulDB CTI ID #352071.

Workarounds

• Implement a reverse proxy or WAF rule to block or filter requests to the vulnerable endpoint
• Apply file type restrictions at the web server level to prevent upload of executable files
• Add authentication requirements or IP-based access controls to the plugin management endpoints
• Monitor plugin directories with file integrity monitoring tools to detect unauthorized changes

# Example: Restrict access to the vulnerable endpoint using nginx
location /api/v1/agent/hub/refresh {
    # Deny all external access
    deny all;
    # Or restrict to specific trusted IPs
    # allow 10.0.0.0/8;
    # deny all;
}