CVE-2026-80104 Overview
CVE-2026-80104 is a path traversal vulnerability in DB-GPT that allows unauthenticated remote attackers to write arbitrary files to any location the server process can access. The flaw resides in the skill_upload function within packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py, which trusts the client-supplied file.filename value when constructing the destination path. Because the endpoint's only authentication dependency returns an admin-role request regardless of headers, the upload route is reachable without credentials. Attackers can drop a Python module inside the application package and obtain code execution when the server imports it.
Critical Impact
Unauthenticated remote attackers can write arbitrary Python files inside the DB-GPT application and achieve remote code execution in the server process.
Affected Products
- DB-GPT (eosphoros-ai) version 0.8.0
- dbgpt-app PyPI package containing the vulnerable agentic_data_api.py
- Deployments exposing the DB-GPT OpenAPI skill upload endpoint
Discovery Timeline
- 2026-08-25 - CVE-2026-80104 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-80104
Vulnerability Analysis
The skill_upload handler accepts a multipart file upload and constructs its destination as upload_dir / filename, using Python's path operator without normalization. When the right operand is absolute (for example /tmp/x), the left operand is discarded entirely. When the right operand contains parent directory references such as ../../../tmp/x, the resulting path escapes the intended upload root. No code canonicalizes the final path, verifies containment within the upload directory, or blocks executable suffixes like .py.
The route depends only on get_user_from_headers from dbgpt_serve/utils/auth.py. That helper returns a request object carrying the admin role whether or not a user_id header is provided. As a result, the endpoint accepts anonymous requests and treats them as privileged. This weakness is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).
Root Cause
The root cause is a combination of two defects. First, the upload handler concatenates an attacker-controlled filename onto a base directory without sanitization or containment checks. Second, the authentication dependency grants administrative access by default when no user identity is supplied, removing the authentication barrier that would otherwise limit exploitation.
Attack Vector
A remote attacker sends an unauthenticated multipart POST request to the skill upload endpoint. The filename field is set to a traversal payload such as ../../../path/to/target.py or an absolute path. The server writes the request body to the resolved location. By overwriting or planting a Python module that DB-GPT imports, the attacker triggers code execution in the server process on the next import.
See the VulnCheck Advisory for DB-GPT and the vulnerable source in agentic_data_api.py for technical details.
Detection Methods for CVE-2026-80104
Indicators of Compromise
- Multipart upload requests to the DB-GPT skill upload endpoint containing .. sequences or absolute paths in the filename field.
- New or modified .py files under the DB-GPT application package or Python site-packages directories that do not match the installed release.
- Unexpected files written outside the configured skill upload directory owned by the DB-GPT server user.
- Anomalous outbound connections or child processes originating from the DB-GPT server process after an upload.
Detection Strategies
- Inspect web server and application logs for POST requests to the skill upload route with suspicious Content-Disposition filenames.
- Enable file integrity monitoring on the DB-GPT installation directory and Python package paths to catch unauthorized module changes.
- Alert on Python module imports that resolve to files created after deployment or outside the expected package layout.
Monitoring Recommendations
- Forward DB-GPT access logs and host file-write telemetry to a centralized SIEM for correlation.
- Baseline the contents of the DB-GPT application directory and alert on any unexpected .py file creation.
- Monitor process lineage from the DB-GPT service for unexpected shells, network utilities, or interpreters.
How to Mitigate CVE-2026-80104
Immediate Actions Required
- Upgrade DB-GPT to a fixed release; see the GitHub Release v0.8.1 for the patched version.
- Restrict network access to the DB-GPT OpenAPI endpoints so only trusted clients can reach the skill upload route.
- Audit the DB-GPT application directory and Python package tree for unauthorized .py files and restore known-good copies as needed.
- Rotate any credentials, tokens, or keys accessible to the DB-GPT server process, assuming compromise on exposed 0.8.0 deployments.
Patch Information
Upgrade to DB-GPT v0.8.1 or later from the official GitHub release or the dbgpt-app PyPI package. Review the DB-GPT repository for additional guidance and verify that both the path traversal in skill_upload and the permissive get_user_from_headers behavior are addressed in your deployment.
Workarounds
- Place the DB-GPT service behind an authenticating reverse proxy that blocks unauthenticated access to /api/v1/ upload routes.
- Deploy a WAF rule that rejects multipart uploads whose filename contains .., backslashes, or leading / characters.
- Run the DB-GPT process under a least-privileged account with a read-only application directory to prevent module overwrites.
- Disable or firewall the skill upload endpoint until the patched version is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
