CVE-2026-51864

EUVD-2026-90417
DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py:42). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 58.99%
Common Weakness Enumeration
References
https://gist.github.com/Ro1ME/164a2aff1229df650a5bcc2a039900c5
https://github.com/eosphoros-ai/DB-GPT/issues/3027
https://github.com/eosphoros-ai/DB-GPT/issues/3027