CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-73034 — DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allo...

·Source: NIST NVD

Updated:

Executive Summary

DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the user_id HTTP header of the Python file-upload endpoint. Attackers can send a crafted multipart upload request with a traversal-poisoned user_id header to escape the intended upload directory an

Analysis

DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the user_id HTTP header of the Python file-upload endpoint. Attackers can send a crafted multipart upload request with a traversal-poisoned user_id header to escape the intended upload directory and write attacker-controlled content to locations such as Python startup hooks, cron directories, or agent scripts, resulting in remote code execution. CVSS Score: 9.8. Published: 2026-08-11T20:18:46.470.

Indicators of Compromise (1)

CVE (1)
CVE-2026-73034
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 11, 2026. Verified by: NIST.

Related Threats

HIGHVulnerabilityNEW

CISA KEV: Ray-Project Ray — Ray-Project Ray Code Injection Vulnerability

Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari.

CVE-2025-62593Ray-Project Ray
CISA KEV
LOWVulnerability

Monzo chairman Hoffman steps down

The chairman of UK digital bank Monzo, Gary Hoffman, is standing down months after facing a shareholder revolt following the departure of CEO TS Anil.

Finextra
MEDIUMVulnerability

Irregular faces criticism over ‘spin’ in AI hacking postmortem

The company at the center of a series of incidents in which AI models compromised real-world computer systems during security evaluations is facing criticism after the release of a report that security experts say leaves key questions unanswered.

The Record