CVE-2026-80104 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record

Executive Summary

The DB‑GPT API endpoint /skill_upload allows unauthenticated attackers to write arbitrary files to any writable path on the server, enabling remote code execution. Organizations running DB‑GPT face immediate risk of full system compromise, data exfiltration, and regulatory breach. Decision makers must authorize immediate mitigation (disable the endpoint or apply input validation) and initiate incident response within the next hour.

Verified Facts

• DB‑GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory — article.
• The skill_upload function writes the request body to upload_dir / filename, allowing absolute or traversal paths to resolve outside the intended directory — article.
• No canonicalisation, root‑path check, or .py suffix block is performed on the constructed path — article.
• The endpoint’s only dependency, get_user_from_headers, returns an admin role regardless of the presence of a user_id header, making the route reachable without credentials — article.
• A remote attacker can place a malicious Python module in the application package and achieve code execution when the module is imported — article.

Threat Classification

Unauthenticated Remote Code Execution via insecure file upload (CWE‑22) targeting DB‑GPT deployments (AI/LLM platforms) worldwide; exploitation is currently theoretical but fully feasible given the lack of authentication and path sanitisation (HIGH CONFIDENCE). Motivations are likely to obtain system control for data theft or further lateral movement (MEDIUM CONFIDENCE).

Threat Severity Assessment

• CVSS 9.8 (Critical) – confidence HIGH.
• Remote network‑only exploitation without authentication – confidence HIGH.
• Full confidentiality, integrity, and availability impact (code execution, data breach, service disruption) – confidence HIGH.
• Broad applicability to any environment running the vulnerable DB‑GPT version – confidence MEDIUM.

Business Impact

Successful exploitation permits an attacker to implant malicious Python modules, leading to credential theft, ransomware deployment, or sabotage of AI services, causing operational downtime and loss of AI‑driven revenue. If personal data is accessed, GDPR fines can reach €20 million or 4 % of annual turnover, and NIS2/DORA penalties may apply for failure to protect critical digital services. Reputational damage includes loss of client trust in AI offerings and potential contract termination.

Technical Analysis

The vulnerability resides in skill_upload (packages/dbgpt‑app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py) which writes the uploaded file to upload_dir / filename. Path concatenation discards the left operand when the supplied filename is absolute (e.g., /tmp/x) or contains parent‑directory references (e.g., ../../../tmp/x), allowing directory traversal. No canonicalisation or suffix filtering is performed, so a .py file can be placed inside the application package. Authentication is bypassed because get_user_from_headers (dbgpt_serve/utils/auth.py) always returns an admin role, making the endpoint publicly accessible. An attacker can therefore write arbitrary bytes to any writable location and achieve code execution when the malicious module is imported by the server process. CWE‑22 (Path Traversal) is the root cause; CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

CVE Analysis

• CVE‑2026‑80104 – DB‑GPT (all versions) – CWE‑22 – Network‑only, No Authentication required – No patch disclosed at time of publication.

MITRE ATT&CK Mapping

• Initial Access → T1190: Exploit Public‑Facing Application — the unauthenticated file‑upload endpoint is directly exploitable.
• Execution → T1059.007: Command and Scripting Interpreter: Python — malicious .py module is executed by the Python runtime.
• Impact → T1486: Data Encrypted for Impact (potential ransomware after code execution) — inferred from the ability to run arbitrary code.

IOC Intelligence

No public IOCs confirmed at time of publication.

Defenders should create hunt rules for the following behavioral indicators:

• HTTP POST requests to /skill_upload containing a filename with “../” or a leading “/”.
• Creation of new *.py files in the DB‑GPT installation directory outside the designated upload folder.
• Unexpected import or loading of a newly added Python module by the DB‑GPT process (e.g., sys.modules entry).
• Immediate launch of a Python interpreter (process name python.exe or python3) by the web‑application user after a file upload.

Detection Engineering Guidance

Collect and correlate the following logs:

• Web server access logs (e.g., Nginx access.log) – filter for POST /skill_upload with suspicious filename patterns.
• Application logs – monitor for file‑write errors or warnings in skill_upload module.
• OS audit logs (Linux auditd) – watch for open or creat syscalls targeting paths ending in *.py outside the upload directory.
• Process creation logs (Sysmon Event ID 1) – detect python.exe processes spawned by the DB‑GPT service account within seconds of a file upload.

Correlate the timestamp of the upload request with subsequent file creation and process launch events to generate a high‑confidence alert.

Sigma Rules

title: Suspicious DB-GPT Skill Upload Path Traversal
id: 3f9c2a1e-5b4d-4f9a-8c2e-1a7d9e6b4f12
status: stable
description: Detects HTTP POST to /skill_upload with a filename containing directory traversal or absolute path, indicating exploitation of CVE-2026-80104.
author: CYBERDUDEBIVASH Sentinel Apex
logsource:
    product: nginx
    service: webserver
detection:
    selection:
        http_method: POST
        uri: /skill_upload
        request_body|contains:
            - '../'
            - '/'
    condition: selection
falsepositives:
    - Internal testing of file upload functionality
level: high
tags:
    - attack.t1190

title: Creation of Unauthorized Python Module in DB-GPT Directory
id: d2a7c9f4-6e3b-4a1d-9f5b-2c8e7d1a3b6e
status: stable
description: Detects creation of .py files in the DB-GPT installation path outside the designated upload folder, a hallmark of CVE-2026-80104 exploitation.
author: CYBERDUDEBIVASH Sentinel Apex
logsource:
    product: linux
    service: auditd
detection:
    selection:
        syscall: openat
        exe: /usr/bin/python3
        a0|endswith: ".py"
        a1|contains: "O_CREAT"
        a2|contains: "/opt/dbgpt"
    condition: selection
falsepositives:
    - Legitimate deployment of new Python modules by developers
level: high
tags:
    - attack.t1059.007

Threat Hunting Queries

• Hypothesis: Attackers upload files with traversal sequences – query Nginx access logs for POST /skill_upload where request_body contains “../” or starts with “/”.
• Hypothesis: Malicious Python modules are written to the DB‑GPT codebase – query Linux audit logs for openat syscalls creating *.py files under /opt/dbgpt/* outside the upload folder.
• Hypothesis: New Python modules are imported after upload – query Sysmon Event ID 1 for python.exe processes with command line arguments pointing to newly created .py files in the DB‑GPT directory.
• Hypothesis: Unauthorized admin actions follow file upload – query application logs for successful admin role assignments immediately after a /skill_upload request.
• Hypothesis: Unexpected outbound connections from the DB‑GPT service after code execution – query network flow logs for connections from the DB‑GPT process to external IPs within 5 minutes of a file upload.

SOC Analyst Play

🔗 Related Intelligence Reports

• Related topic: CVE-2026-79787 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-76193 — CVSS 10.0 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-76195 — CVSS 10.0 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-76197 — CVSS 10.0 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-16286 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record