{"id":"CVE-2026-73034","title":"DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the user_id HTTP header of the Pyt…","summary":"DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the user_id HTTP header of the Pyt…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-22"],"published":"2026-08-11","updated":"2026-09-23","sourceUpdated":"2026-09-23T17:17:42.280","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73034","references":[{"url":"https://github.com/eosphoros-ai/DB-GPT","label":"disclosure@vulncheck.com"},{"url":"https://github.com/eosphoros-ai/DB-GPT/commit/e0c741bd2b5e521b128cffb3f68982dde3f7b359","label":"disclosure@vulncheck.com"},{"url":"https://github.com/eosphoros-ai/DB-GPT/issues/3104","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/db-gpt-path-traversal-arbitrary-file-write-via-user-id-header","label":"disclosure@vulncheck.com"},{"url":"https://github.com/eosphoros-ai/DB-GPT/issues/3104","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","exploit-available"],"epss":0.05122,"epssPercentile":0.92015,"exploits":{"github":1,"githubRepos":["https://github.com/Boreas37/CVE-2026-73034-PoC"],"nuclei":["CVE-2026-73034"],"checkedAt":"2026-09-23T17:28:48.954Z"},"exploitAvailable":true,"ingestedAt":"2026-09-23T17:28:14.798Z","slug":"CVE-2026-73034","body":"## Overview\n\nDB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the user_id HTTP header of the Python file-upload endpoint. Attackers can send a crafted multipart upload request with a traversal-poisoned user_id header to escape the intended upload directory and write attacker-controlled content to locations such as Python startup hooks, cron directories, or agent scripts, resulting in remote code execution.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":67,"depthScoreParts":{"impact":53.9,"likelihood":1,"exploitation":12,"ransomware":0},"changes":[]}