CVE-2026-51862

EUVD-2026-90418
DB-GPT 0.8.0 contains directory traversal in skill_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py:40). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 58.99%
Common Weakness Enumeration
References
https://gist.github.com/Ro1ME/c09e6aca2e9c7280ca4fabb1f44dcd2a
https://github.com/eosphoros-ai/DB-GPT/issues/3026
https://gist.github.com/Ro1ME/c09e6aca2e9c7280ca4fabb1f44dcd2a
https://github.com/eosphoros-ai/DB-GPT/issues/3026