DB-GPT Unauthenticated Path Traversal Leading to Remote Code Execution

Technical Analysis

The vulnerability stems from insufficient sanitization of the user_id header in DB-GPT's multipart file-upload endpoint, allowing directory traversal sequences (e.g., ../../) to escape the intended upload directory. Attackers can leverage this to plant malicious files in sensitive locations such as Python site-packages startup hooks, cron job directories, or systemd service paths, achieving code execution in the context of the DB-GPT service. The CVSS score of 9.8 reflects network-exploitable, unauthenticated access with high impact to confidentiality, integrity, and availability. DB-GPT is a widely used open-source framework for building LLM-powered data agents and RAG pipelines over private databases, meaning this flaw directly threatens organizations running autonomous AI agents on top of it. Successful exploitation could allow attackers to overwrite agent orchestration scripts, inject malicious tool-calling logic, exfiltrate connected database credentials, or pivot into downstream systems that the agent has access to, representing a severe and direct threat to AI agent infrastructure.

Affected Systems

DB-GPT version 0.8.1 (and potentially earlier/unpatched versions) - specifically the Python-based file-upload API endpoint that processes multipart requests with a user_id header; self-hosted DB-GPT deployments exposed to untrusted network access.

Indicators of Compromise

• Malicious multipart POST requests to DB-GPT upload endpoint containing traversal sequences (e.g., ../../../../) in the user_id header
• Unexpected files written to Python site-packages, cron.d, /etc/cron.*, or systemd unit directories
• Unusual outbound connections from DB-GPT host processes following file upload activity
• Modified or newly created agent script files with unexpected timestamps

Remediation Steps

1. 1

   Patch or Upgrade DB-GPT

   Apply the vendor patch or upgrade to a DB-GPT release that sanitizes the user_id header and enforces canonical path validation on the upload endpoint.

2. 2

   Restrict Network Exposure

   Ensure DB-GPT instances are not directly exposed to the internet; place behind authentication proxies, VPNs, or zero-trust network access controls.

3. 3

   Input Validation and WAF Rules

   Deploy a web application firewall rule to block traversal sequences (../, %2e%2e%2f, etc.) in HTTP headers, particularly on upload endpoints.

4. 4

   File Integrity Monitoring

   Enable monitoring on cron directories, systemd unit paths, and Python package/site-packages locations to detect unauthorized file writes.

5. 5

   Audit Agent Scripts and Credentials

   Review any AI agent orchestration scripts, tool configurations, and database credentials accessible to DB-GPT for signs of tampering or exfiltration, and rotate credentials if compromise is suspected.

6. 6

   Least Privilege for Service Accounts

   Run DB-GPT under a low-privilege service account with restricted filesystem write access to reduce blast radius of any successful traversal exploit.