CVE-2026-51862

CRITICALCVSS 9.1

Description

DB-GPT 0.8.0 contains directory traversal in skill_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py:40). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary.

Timeline

Published:September 30th, 2026 9:17 PM

Last modified:October 7th, 2026 4:17 PM

CVSS Scoring

CVSS v3: 9.1 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-22

References & Reports

Advisories, patches, and third-party reports

https://gist.github.com/Ro1ME/c09e6aca2e9c7280ca4fabb1f44dcd2a
https://github.com/eosphoros-ai/DB-GPT/issues/3026
https://gist.github.com/Ro1ME/c09e6aca2e9c7280ca4fabb1f44dcd2a
https://github.com/eosphoros-ai/DB-GPT/issues/3026

Source: NIST NVD · Data may lag official sources by up to one minute