Loading story…
DB-GPT versions 0.8.0 through before 0.8.1 are affected by CVE-2026-80104, a critical path-traversal and arbitrary-file-write flaw in the skill_upload API. The endpoint incorporates attacker-controlled multipart filenames directly into destination paths, allowing absolute paths or .. sequences to escape the intended upload directory. A separate authentication defect treats requests without a user_id header as administrative, enabling remote unauthenticated attackers to write content wherever the DB-GPT process has permission.
Attackers could overwrite or plant Python modules in writable application paths and gain server-side code execution when those modules are imported. The issue is rated CVSS 9.8 under v3.1 and 9.3 under v4.0. DB-GPT v0.8.1 adds filename validation and other hardening, including restrictions on personal skill-script execution and authentication requirements for knowledge-module endpoints; organizations running earlier releases should upgrade and investigate potentially altered application files.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-80104 was published for a critical flaw affecting DB-GPT 0.8.0 through versions earlier than 0.8.1. The skill-upload endpoint accepted traversal or absolute multipart filenames and, because its authentication handling treated unauthenticated requests as administrative, could let remote attackers write files to server-writable paths and potentially obtain code execution through Python-module imports.
DB-GPT released version 0.8.1, adding validation for skill-upload, Python-upload, and example-file names, restricting personal skill-script execution, and adding authentication to knowledge-module endpoints. The release also hardened configuration-file permissions and introduced product and compatibility updates.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
6 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcevulncheck.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcepypi.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability tracked as **CVE-2026-73034** affects **eosphoros-ai DB-GPT** up to and including version **0.8.1**, allowing unauthenticated attackers to exploit the Python file-upload endpoint by placing directory traversal sequences in the `user_id` HTTP header. The flaw lets remote attackers escape the intended upload directory and write arbitrary files anywhere on the server, creating broad risk to confidentiality, integrity, and availability under the published **CVSS 3.1** vector `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`. Advisories warn that attackers could place controlled files in sensitive locations such as Python startup hooks, cron directories, or agent scripts, potentially escalating the arbitrary file write into **remote code execution**. A security patch in the DB-GPT repository hardens the upload logic by restricting `user_id` to alphanumeric characters, underscores, and hyphens, resolving uploads only under the `python_uploads` base directory, and enforcing containment checks to block traversal, TOCTOU, and symlink-based escapes; added tests also verify rejection of traversal payloads and unsafe path conditions.
Aug 15, 2026
OpenBMB ChatDev through version **2.2.0** is affected by **`CVE-2026-58166`**, a critical unauthenticated path traversal flaw in its file upload handler that lets remote attackers write or delete arbitrary files on the server. The vulnerability stems from the `POST` uploads session endpoint, where a malicious multipart filename containing traversal sequences or an absolute path is passed into `save_upload_file` without proper sanitization, allowing attacker-controlled filesystem paths to be used during upload and cleanup operations. The issue is rated **CVSS 3.1 9.1 (Critical)**, with a listed **CVSS 4.0 8.8 (High)**, and is considered remotely exploitable without authentication. The flaw was fixed in commit **`4fd4da6`**, and affected organizations should update to a patched release and enforce strict validation and sanitization of upload filenames and paths to prevent arbitrary file write or deletion.
Jul 1, 2026
Two application vulnerabilities have exposed AGiXT and Bugsink servers to filesystem-level attacks that can lead to full host compromise. In AGiXT, advisory `GHSA-5gfj-64gh-mgmw` describes an authenticated path traversal flaw in the Essential Abilities Extension, rated **CVSS 8.8**, that lets an attacker escape intended directories and access files with the permissions of the AGiXT process. The issue allows arbitrary read, write, and delete operations against sensitive targets including environment files, configuration data, database credentials, cryptographic keys, `/etc/shadow`, and `.ssh/id_rsa`, creating high risk to confidentiality, integrity, and availability. A separate flaw tracked as `CVE-2026-40162` affects Bugsink and enables authenticated arbitrary file write or overwrite within the application's runtime permissions, with a **CVSS 7.1** rating. The weakness can be used to overwrite Python source files or module initialization scripts so attacker-controlled code executes on restart or when a new worker is spawned, effectively turning file access into remote code execution. Both disclosures warn that deployments running with elevated privileges or broad filesystem access face the greatest danger, including persistence through locations such as cron directories, `.ssh/authorized_keys`, or application package paths, as well as exposure of secrets, telemetry, and backend credentials.
Jun 29, 2026