Directory Traversal in DB-GPT Skill Upload

Executive Summary

DB-GPT 0.8.0 has a directory traversal vulnerability in the skill_upload function located in the file packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py at line 40. This flaw allows a remote attacker to write files outside the intended workspace or storage boundary by exploiting a validated path.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect the skill_upload functionality in DB-GPT 0.8.0 for improper path validation. Check the file packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py for directory traversal patterns, such as sequences like '../' in user inputs. Monitor network traffic for file upload requests targeting this endpoint.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to overwrite critical files, inject malicious code, or gain unauthorized access to sensitive data by writing files outside the intended storage area. This may lead to system compromise or data breaches.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade DB-GPT to a patched version if available. If not, restrict access to the skill_upload endpoint via network controls or disable it. Implement strict input validation to reject paths containing '../' or similar traversal sequences. Review file permissions to ensure uploaded files cannot be written outside intended directories.

Useful 0 Not Useful 0