CVE-2026-80104 - DB-GPT 0.8.0 Path Traversal Arbitrary File Write via Skill Upload Filename
Brief
CVE ID : CVE-2026-80104
Published : Aug. 25, 2026, 8:18 p. m.
- 54 minutes ago
Description : DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory. skill_upload in packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api. py takes file. filename as given and writes the request body to upload_dir / filename.
A path composed with that operator discards the left operand when the right one is absolute and follows parent references otherwise, so a filename such as .. /.. /.. /tmp/x or /tmp/x resolves outside the intended directory; nothing canonicalises the result, checks that it remains under the upload root, or prevents a . py suffix. The route's only dependency is get_user_from_headers in dbgpt_serve/utils/auth.