DB-GPT: Directory traversal in Python file upload
Summary
DB-GPT v0.7.5 and v0.8.0 contain a directory traversal flaw in the Python file upload function (python_file_upload). The uploaded filename is used without validation, so crafted path sequences such as ../ can place a .py file outside the user's upload directory. The issue report describes this as exploitable by authenticated users, while the CVSS vector indicates no privileges or user interaction are required. Written Python files can later be imported or executed by the application, so the impact can extend to code execution.
Affected
- DB-GPT v0.7.5
- DB-GPT v0.8.0
- Earlier versions are possibly affected (unconfirmed)
Fixed in
Unknown. No vendor advisory or fixed release for CVE-2026-51864 has been found. Do not assume that version 0.8.1 fixes this issue.
Workaround
- Remove public exposure of the DB-GPT API and the Python upload route (/api/v1/python/upload).
- Restrict access to the upload endpoint to trusted internal clients, for example with a VPN, authentication or a network allow-list.
- Limit the file-system write permissions of the DB-GPT service account.
Exploitation
- CISA SSVC: exploitation status 'poc', automatable: yes, technical impact: total.
- Not listed in CISA KEV.
- Public proof-of-concept status is conflicting: one source reports no confirmed public exploit, while another describes a PoC against v0.8.0.
- EPSS: 0.00735 (early value).
Our recommendation
- Inventory all DB-GPT instances, including the dbgpt-app package and Docker images, and record their versions.
- Remove internet exposure of DB-GPT immediately if present and treat exposed instances as urgent.
- Restrict access to the upload endpoint and monitor requests for path traversal sequences such as ../.
- Check the DB-GPT issue #3027 and the repository for a vendor fix before closing this item, and recheck the NVD score once analysis is complete.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- NVD-Eintrag Gist: CVE-2026-51864 Directory Traversal in DB-GPT gist.github.com
- DB-GPT Issue #3027: Path Traversal in python_file_upload github.com
- VulDB: CVE-2026-51864 vuldb.com
- Vulners VulnRichment: CVE-2026-51864 vulners.com
- TheHackerWire: CVE-2026-51864 www.thehackerwire.com
- Strix: CVE-2026-51864 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:48.
Original description (NVD)
DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py:42). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.