CVE-2026-80104: DB-GPT skill upload writes past the upload directory

Two different unauthenticated path-traversal arbitrary file writes hit DB-GPT upload APIs. CVE-2026-80104 is the skill-upload multipart filename bug in agentic_data_api.py. Its sibling CVE-2026-73034 is the python-upload user_id HTTP header bug in python_upload_api.py. Upgrading to the latest PyPI release closes only the first one. That is the operator fact a single advisory page usually misses.

Who is not in scope

Deployments that do not expose the agentic skill upload HTTP API (/v1/agentic_data/skill/upload and related skill upload routes) and do not expose the python file upload HTTP API (/api/v1/python/file/upload) are not on these paths. Builds that already carry both _validate_upload_filename in agentic_data_api.py and _SAFE_USER_ID_RE / _resolve_user_id in python_upload_api.py (as on main after commit e0c741bd) are already past both bugs. This article is not about other DB-GPT upload issues (plugin code execution, skill script execution, Jinja skill.md SSTI). Those are separate bugs with separate fixes.

What broke

In DB-GPT 0.8.0, skill_upload in packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py took the multipart file.filename and joined it onto pilot/tmp with no filename validation. A name with ../ segments writes outside the intended upload directory. Auth does not stop this: get_user_from_headers in packages/dbgpt-serve/src/dbgpt_serve/utils/auth.py is a mock that returns role="admin" whether or not a user_id header is set. GitHub issue #3026 tracks the skill-upload traversal. The fix landed as commit aecad1a9 (PR #3065, May 2026), which adds _validate_upload_filename and rejects absolute paths, multi-segment names, and ... That helper is present on tagged/PyPI v0.8.1. CVE-2026-80104 was assigned 2026-08-25.

CVE-2026-73034 is a different write. The python upload handler builds upload_dir = os.path.join(base_dir, "python_uploads", user_id) from the user_id header (FastAPI maps it as user-id). Filename containment via _resolve_upload_path only checks the filename relative to that already-poisoned directory, so a traversal in user_id escapes the uploads root. GitHub issue #3104 confirmed an unauthenticated write outside the working directory. The same mock auth applies. This bug is still present on tagged and PyPI v0.8.1: that tree has no _SAFE_USER_ID_RE. The fix exists on main as commit e0c741bd (_SAFE_USER_ID_RE / _resolve_user_id). There is no v0.8.2 GitHub release tag and no PyPI 0.8.2 as of research time. Latest on PyPI for both dbgpt-app and dbgpt is 0.8.1.

pip show dbgpt-app
# expect Version: 0.8.1 (or older) on current PyPI; there is no 0.8.2 wheel yet

python - <<'PY'
from importlib.util import find_spec
from pathlib import Path
spec = find_spec("dbgpt_app")
root = Path(spec.origin).resolve().parent
agentic = root / "openapi" / "api_v1" / "agentic_data_api.py"
python_up = root / "openapi" / "api_v1" / "python_upload_api.py"
print("agentic_data_api", agentic)
print("_validate_upload_filename", "_validate_upload_filename" in agentic.read_text())
print("python_upload_api", python_up)
print("_SAFE_USER_ID_RE", "_SAFE_USER_ID_RE" in python_up.read_text())
PY

pip install --upgrade 'dbgpt-app==0.8.1'
# then re-run the helper check above

This article is the operator write-up for both upload-path writes. The HOL Guard evidence page is the source record for CVE-2026-80104; sibling evidence for CVE-2026-73034 is at HOL Guard CVE-2026-73034.

References

• CVE-2026-80104
• CVE-2026-73034
• DB-GPT issue #3026 (skill upload path traversal)
• PR #3065 / commit aecad1a9 (_validate_upload_filename)
• DB-GPT issue #3104 (python upload user_id traversal)
• commit e0c741bd (_SAFE_USER_ID_RE on main)
• PyPI dbgpt-app (latest 0.8.1)