Path Traversal Vulnerability in DB-GPT by Eosphoros AI

CVE-2026-80104

What is CVE-2026-80104?

A path traversal vulnerability in DB-GPT allows attackers to manipulate file upload paths, potentially leading to arbitrary file writes outside the intended directory. The affected component, skill_upload, does not validate the destination path against the upload directory. This flaw permits unauthorized users to exploit the upload functionality and execute arbitrary code on the server by placing malicious Python modules in accessible locations. This issue stems from an unrestrained use of the multipart filename, making it possible to traverse directories using sequences like ../../../. Without appropriate authentication, an attacker can gain access to this vulnerability, posing critical security risks to applications using DB-GPT.

References