CVE-2026-73034: DB-GPT Path Traversal Vulnerability

CVE-2026-73034 Overview

CVE-2026-73034 is an unauthenticated path traversal vulnerability [CWE-22] in DB-GPT v0.8.1, an open-source AI-native data application framework. The flaw resides in the Python file-upload endpoint, which trusts the user_id HTTP header without sanitization. Remote attackers inject directory traversal sequences into this header to escape the intended upload directory and write attacker-controlled content to arbitrary locations on the server. Writable targets include Python startup hooks, cron directories, and agent scripts, enabling remote code execution. No authentication is required to trigger the vulnerability.

Critical Impact
Unauthenticated remote attackers can write arbitrary files anywhere the DB-GPT process can reach, leading to full remote code execution on the host.

Affected Products

DB-GPT v0.8.1 (eosphoros-ai)
Deployments exposing the Python file-upload API endpoint
Instances running the vulnerable python_upload_api.py handler

Discovery Timeline

2026-08-11 - CVE-2026-73034 published to the National Vulnerability Database
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-73034

Vulnerability Analysis

DB-GPT exposes a FastAPI-based Python file-upload endpoint implemented in packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py. The endpoint constructs the destination file path by concatenating a base upload directory with the value of the user_id HTTP header supplied by the client. The handler performs no validation on this header, allowing traversal sequences such as ../ to redirect the write operation outside the intended sandbox.

Because the endpoint requires no authentication, any network-reachable attacker can craft a multipart upload request and control both the destination path and file contents. Writing to Python site-packages, __pycache__, cron directories, or DB-GPT agent script paths converts the file write into arbitrary code execution under the service account.

Root Cause

The root cause is missing input validation on a user-controlled HTTP header used to build a filesystem path. The vulnerable code trusts the user_id header as an identity token and reuses it as a directory component. This dual purpose, combined with the absence of canonicalization checks, produces a classic path traversal condition [CWE-22].

Attack Vector

An attacker sends an unauthenticated HTTP POST multipart request to the Python file-upload endpoint. The user_id header contains traversal payloads such as ../../../../etc/ or a path targeting Python startup scripts. The server writes the attached file content to the resolved location. Subsequent execution of that location, either through a scheduled task, service restart, or agent invocation, yields remote code execution.

python

 import logging
 import os
+import re
 from pathlib import Path
 
-from fastapi import APIRouter, Depends, File, UploadFile
+from fastapi import APIRouter, Depends, File, HTTPException, UploadFile
 
 from dbgpt._private.config import Config
 from dbgpt_app.openapi.api_view_model import Result

Source: GitHub Commit e0c741b. This patch introduces the re module and HTTPException import, enabling regex-based validation of the user_id header and immediate rejection of malformed values before any filesystem operation occurs.

Detection Methods for CVE-2026-73034

Indicators of Compromise

HTTP requests to the Python upload endpoint containing .., %2e%2e, or absolute path characters in the user_id header
New or modified files under Python startup directories, cron paths, or DB-GPT agent script folders that do not match expected deployment artifacts
Unexpected child processes spawned by the DB-GPT service account shortly after upload requests
Outbound network connections from the DB-GPT host to unknown infrastructure following file upload activity

Detection Strategies

Inspect reverse proxy and web application firewall logs for user_id header values containing traversal sequences or path separators
Monitor filesystem integrity for writes to /etc/cron.*, Python site-packages, sitecustomize.py, and DB-GPT plugin directories
Correlate upload API calls with subsequent process creation events on the same host

Monitoring Recommendations

Enable verbose access logging on the DB-GPT reverse proxy, including all request headers, for post-incident analysis
Deploy file integrity monitoring on directories the DB-GPT process can write to
Alert on any process execution originating from directories that receive uploaded content

How to Mitigate CVE-2026-73034

Immediate Actions Required

Restrict network access to the DB-GPT Python file-upload endpoint using firewall rules or reverse proxy allowlists
Apply the upstream security commit that validates the user_id header before use
Audit filesystem paths writable by the DB-GPT service account for unexpected files created since deployment
Rotate any credentials or API keys stored on affected hosts

Patch Information

The fix is available in commit e0c741b in the eosphoros-ai/DB-GPT repository. The patch adds regex-based validation of the user_id header in python_upload_api.py and raises an HTTPException on malformed input. Refer to the VulnCheck Advisory on DB-GPT and GitHub Issue #3104 for full advisory context.

Workarounds

Place DB-GPT behind an authenticating reverse proxy that strips or rewrites the user_id header on inbound requests
Run the DB-GPT process as an unprivileged user with a read-only root filesystem and a narrowly scoped writable volume
Deploy a WAF rule that blocks requests containing .., %2e%2e, /, or \ in the user_id header

bash

# Example NGINX snippet to reject traversal in the user_id header
if ($http_user_id ~* "(\.\.|/|\\|%2e%2e)") {
    return 400;
}