DB-GPT <= 0.8.1 - Arbitrary File Write

DB-GPT through 0.8.1 allows unauthenticated arbitrary file writes via a path traversal in the userid HTTP header of the POST /api/v1/python/file/upload endpoint, letting attackers escape the intended upload directory and write files anywhere, as confirmed by the reflected upload path in the JSON...

CVE-2026-123019

A flaw was found in DB-GPT's Hugging Face adapter. A remote attacker could exploit this vulnerability by manipulating the trustremotecode setting when loading model repositories. This causes the application to include and run untrusted external code, leading to arbitrary code execution on the hos...

CVE-2026-123020

A flaw was found in DB-GPT. The application fails to properly sanitize user input before passing it to the Jinja2 template engine in the skill prompt component. A remote attacker could exploit this vulnerability by submitting crafted template expressions, leading to server-side template injection...

CVE-2026-123018

A flaw was found in DB-GPT. A remote attacker could exploit this vulnerability by submitting manipulated input to the executecode function within the CodeAction component. This flaw allows the attacker to execute arbitrary code on the underlying host system, potentially compromising the host...

CVE-2026-123020

A security vulnerability has been detected in eosphoros-ai DB-GPT up to 0.8.1. The affected element is the function FileBasedSkill.getprompt of the file packages/dbgpt-core/src/dbgpt/agent/skill/claudeskill/init.py of the component Jinja2 Template Handler. The manipulation leads to improper...

CVE-2026-123020

A security vulnerability exists in eosphoros-ai DB-GPT versions up to 0.8.1 within the Jinja2 Template Handler component. The flaw is located in the FileBasedSkill.get_prompt function of the file packages/dbgpt-core/src/dbgpt/agent/skill/claude_skill/__init__.py. The root cause is the improper ne...

CVE-2026-123020 eosphoros-ai DB-GPT Jinja2 Template __init__.py FileBasedSkill.get_prompt special elements in template engine

A security vulnerability has been detected in eosphoros-ai DB-GPT up to 0.8.1. The affected element is the function FileBasedSkill.getprompt of the file packages/dbgpt-core/src/dbgpt/agent/skill/claudeskill/init.py of the component Jinja2 Template Handler. The manipulation leads to improper...

CVE-2026-123020 eosphoros-ai DB-GPT Jinja2 Template __init__.py FileBasedSkill.get_prompt special elements in template engine

A security vulnerability has been detected in eosphoros-ai DB-GPT up to 0.8.1. The affected element is the function FileBasedSkill.getprompt of the file packages/dbgpt-core/src/dbgpt/agent/skill/claudeskill/init.py of the component Jinja2 Template Handler. The manipulation leads to improper...

EUVD-2026-117434

A security vulnerability has been detected in eosphoros-ai DB-GPT up to 0.8.1. The affected element is the function FileBasedSkill.getprompt of the file packages/dbgpt-core/src/dbgpt/agent/skill/claudeskill/init.py of the component Jinja2 Template Handler. The manipulation leads to improper...

CVE-2026-123019

A weakness has been identified in eosphoros-ai DB-GPT up to 0.8.2. Impacted is the function execmodule of the file hfadapter.py of the component HuggingFace Adapter. Executing a manipulation of the argument trustremotecode can lead to inclusion of functionality from untrusted control sphere. The...

CVE-2026-123018

A security flaw has been discovered in eosphoros-ai DB-GPT up to 0.8.2. This issue affects the function executecode of the file codeutils.py of the component CodeAction. Performing a manipulation results in code injection. The attack can be initiated remotely. The exploit has been released to the...

CVE-2026-123019 eosphoros-ai DB-GPT HuggingFace Adapter hf_adapter.py exec_module inclusion of functionality from untrusted control sphere

A weakness has been identified in eosphoros-ai DB-GPT up to 0.8.2. Impacted is the function execmodule of the file hfadapter.py of the component HuggingFace Adapter. Executing a manipulation of the argument trustremotecode can lead to inclusion of functionality from untrusted control sphere. The...

EUVD-2026-117415

A weakness has been identified in eosphoros-ai DB-GPT up to 0.8.2. Impacted is the function execmodule of the file hfadapter.py of the component HuggingFace Adapter. Executing a manipulation of the argument trustremotecode can lead to inclusion of functionality from untrusted control sphere. The...

CVE-2026-123019

A weakness exists in eosphoros-ai DB-GPT up to version 0.8.2 within the HuggingFace Adapter component. Specifically, the exec_module function in the hf_adapter.py file is vulnerable to the manipulation of the trust_remote_code argument. This flaw allows for the inclusion of functionality from an ...

CVE-2026-123019 eosphoros-ai DB-GPT HuggingFace Adapter hf_adapter.py exec_module inclusion of functionality from untrusted control sphere

A weakness has been identified in eosphoros-ai DB-GPT up to 0.8.2. Impacted is the function execmodule of the file hfadapter.py of the component HuggingFace Adapter. Executing a manipulation of the argument trustremotecode can lead to inclusion of functionality from untrusted control sphere. The...

EUVD-2026-117405

A security flaw has been discovered in eosphoros-ai DB-GPT up to 0.8.2. This issue affects the function executecode of the file codeutils.py of the component CodeAction. Performing a manipulation results in code injection. The attack can be initiated remotely. The exploit has been released to the...

CVE-2026-123018

A security flaw exists in eosphoros-ai DB-GPT versions up to 0.8.2 . The vulnerability is located in the CodeAction component, specifically within the execute_code function of the code_utils.py file. A remote attacker can perform a manipulation leading to code injection . An exploit has been rele...

CVE-2026-123018 eosphoros-ai DB-GPT CodeAction code_utils.py execute_code code injection

A security flaw has been discovered in eosphoros-ai DB-GPT up to 0.8.2. This issue affects the function executecode of the file codeutils.py of the component CodeAction. Performing a manipulation results in code injection. The attack can be initiated remotely. The exploit has been released to the...

CVE-2026-123018 eosphoros-ai DB-GPT CodeAction code_utils.py execute_code code injection

A security flaw has been discovered in eosphoros-ai DB-GPT up to 0.8.2. This issue affects the function executecode of the file codeutils.py of the component CodeAction. Performing a manipulation results in code injection. The attack can be initiated remotely. The exploit has been released to the...

CVE-2026-73034-PoC

CVE-2026-73034 — DB-GPT v0.8.1 Unauthenticated Path Traversal → Arbitrary File Write CVSS 9.8 Critical · CWE-22 · GHSA/Issue 3104 Summary POST /api/v1/python/file/upload in DB-GPT v0.8.1 takes the user-id HTTP header and uses it raw as a path component : uploaddir = os.path.joinbasedir,...