Live › vulnerability › CVE-2026-51863
DB-GPT versions 0.7.5 and 0.8.0 have a directory traversal flaw in the use_example_file function of its examples API. A remote attacker can write files outside the intended workspace or storage directory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 18:26 UTC. All times on this page are UTC.
Self-hosted DB-GPT 0.7.5 and 0.8.0 that expose the /api/v1/examples/use endpoint. Per the reporter, the traversal needs a malicious name entry in the EXAMPLE_FILES table, which a remote caller cannot set directly, so real-world risk is lower than the CVE text suggests. Teams on other versions, or with DB-GPT not reachable from untrusted networks, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| DB-GPT | pip | 0.7.5, 0.8.0 | – |
dbgpt --version or the package version in packages/dbgpt-app) and see whether it is 0.7.5 or 0.8.0.packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/examples_api.py around line 129 to confirm the file-path handling in .use_example_fileNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
DB-GPT v0.7.5 and 0.8.0 contains directory traversal in use_example_file (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/examples_api.py:129). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary.
This page as .md · .json · in your agent: get_signal("CVE-2026-51863")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.