Originally published at HOL
CVE-2026-80104: DB-GPT skill upload writes past the upload directory
Two different unauthenticated path-traversal arbitrary file writes hit DB-GPT upload APIs. CVE-2026-80104 is the skill-upload multipart filename bug in agentic_data_api.py. Its sibling CVE-2026-73034 is the python-upload user_id HTTP header bug in python_upload_api.py. Upgrading to the latest PyPI release closes only the first one. That is the operator fact a single advisory page usually misses.
Who is not in scope
Deployments that do not expose the agentic skill upload HTTP API (/v1/agentic_data/skill/upload and related skill upload routes) and do not expose the python file upload HTTP API (/api/v1/python/file/upload) are not on these paths. Builds that already carry both _validate_upload_filename in agentic_data_api.py and _SAFE_USER_ID_RE / _resolve_user_id in python_upload_api.py (as on main after commit e0c741bd) are already past both bugs. This article is not about other DB-GPT upload issues (plugin code execution, skill script execution, Jinja skill.md SSTI). Those are separate bugs with separate fixes.
What broke
In DB-GPT 0.8.0, skill_upload in packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py took the multipart file.filename and joined it onto pilot/tmp with no filename validation. A name with ../ segments writes outside the intended upload directory. Auth does not stop this: get_user_from_headers in packages/dbgpt-serve/src/dbgpt_serve/utils/auth.py is a mock that returns role="admin" whether or not a user_id header is set. GitHub issue #3026 tracks the skill-upload traversal. The fix landed as commit aecad1a9 (PR #3065, May 2026), which adds _validate_upload_filename and rejects absolute paths, multi-segment names, and ... That helper is present on tagged/PyPI v0.8.1. CVE-2026-80104 was assigned 2026-08-25.
CVE-2026-73034 is a different write. The python upload handler builds upload_dir = os.path.join(base_dir, "python_uploads", user_id) from the user_id header (FastAPI maps it as user-id). Filename containment via _resolve_upload_path only checks the filename relative to that already-poisoned directory, so a traversal in user_id escapes the uploads root. GitHub issue #3104 confirmed an unauthenticated write outside the working directory. The same mock auth applies. This bug is still present on tagged and PyPI v0.8.1: that tree has no _SAFE_USER_ID_RE. The fix exists on main as commit e0c741bd (_SAFE_USER_ID_RE / _resolve_user_id). There is no v0.8.2 GitHub release tag and no PyPI 0.8.2 as of research time. Latest on PyPI for both dbgpt-app and dbgpt is 0.8.1.
[
What this is not
This is not a single bug. CVE-2026-80104 is not the user_id-header bug. Upgrading to "latest on PyPI" (0.8.1) fixes the skill-upload filename traversal and leaves the python-upload user_id traversal open. Being on 0.8.1 is not proof that both helpers exist. We are not inventing a 0.8.2 release. We are not claiming these are in CISA KEV. Secondary write-ups that say "fixed in 0.8.2" are describing a release that is not on GitHub tags or PyPI yet; operators need a build that includes e0c741bd or equivalent validation.
How to check
Print the package you actually installed:
pip show dbgpt-app
# expect Version: 0.8.1 (or older) on current PyPI; there is no 0.8.2 wheel yet
Then confirm both helpers in the installed tree (adjust the path to your site-packages or checkout):
python - <<'PY'
from importlib.util import find_spec
from pathlib import Path
spec = find_spec("dbgpt_app")
root = Path(spec.origin).resolve().parent
agentic = root / "openapi" / "api_v1" / "agentic_data_api.py"
python_up = root / "openapi" / "api_v1" / "python_upload_api.py"
print("agentic_data_api", agentic)
print("_validate_upload_filename", "_validate_upload_filename" in agentic.read_text())
print("python_upload_api", python_up)
print("_SAFE_USER_ID_RE", "_SAFE_USER_ID_RE" in python_up.read_text())
PY
On stock PyPI 0.8.1 you should see _validate_upload_filename True and _SAFE_USER_ID_RE False. If both are True, you are on a build that already carries the main-line user_id fix. If the skill upload or python upload routes are not mounted at all, these CVEs are not reachable even when the helpers are missing.
How to fix
Upgrade dbgpt-app to 0.8.1 for CVE-2026-80104, then confirm the python upload user_id fix is in your build:
pip install --upgrade 'dbgpt-app==0.8.1'
# then re-run the helper check above
For CVE-2026-73034, stay on a checkout or image that includes commit e0c741bd (or cherry-pick / backport the _SAFE_USER_ID_RE / _resolve_user_id validation into your 0.8.1 tree). Do not wait on a PyPI 0.8.2 that is not published. Until that commit is present, keep the python upload HTTP API off the network boundary you do not trust, or front it with auth that the stock mock get_user_from_headers does not provide.
](https://github.com/eosphoros-ai/DB-GPT/commit/e0c741bd2b5e521b128cffb3f68982dde3f7b359)
This article is the operator write-up for both upload-path writes. The HOL Guard evidence page is the source record for CVE-2026-80104; sibling evidence for CVE-2026-73034 is at HOL Guard CVE-2026-73034.
