CVE-2026-51862

Deferred Deferred - Pending Action

Directory Traversal in DB-GPT Skill Upload

Publication date: 2026-09-30

Last updated on: 2026-10-07

Assigner: MITRE

Description

DB-GPT 0.8.0 contains directory traversal in skill_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py:40). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-01

EPSS Evaluated

2026-10-18

NVD

CVE-2026-51862

Affected Vendors & Products

Vendor	Product	Version / Range
eosphoros-ai	db-gpt	0.8.0
eosphoros-ai	db-gpt	From 0.8.0rc6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

DB-GPT 0.8.0 has a directory traversal vulnerability in the skill_upload function located in the file packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py at line 40. This flaw allows a remote attacker to write files outside the intended workspace or storage boundary by exploiting a validated path.

Detection Guidance

To detect this vulnerability, inspect the skill_upload functionality in DB-GPT 0.8.0 for improper path validation. Check the file packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py for directory traversal patterns, such as sequences like '../' in user inputs. Monitor network traffic for file upload requests targeting this endpoint.

Impact Analysis

This vulnerability could allow an attacker to overwrite critical files, inject malicious code, or gain unauthorized access to sensitive data by writing files outside the intended storage area. This may lead to system compromise or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Immediately upgrade DB-GPT to a patched version if available. If not, restrict access to the skill_upload endpoint via network controls or disable it. Implement strict input validation to reject paths containing '../' or similar traversal sequences. Review file permissions to ensure uploaded files cannot be written outside intended directories.

Hi! I’m here to help you understand CVE-2026-51862. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70