CVE-2026-80104

Name of the Vulnerable Software and Affected Versions dbgpt-app versions prior to 0.8.1

Description An issue exists in the skill upload endpoint within packages/dbgpt-app/src/dbgpt app/openapi/api v1/agentic data api.py where the destination path for uploaded skills is constructed using the multipart filename without proper constraints. Because the application does not canonicalize the result or verify that the path remains within the upload root, a remote attacker can use absolute paths or parent directory references (e.g., ../../../tmp/x) to write arbitrary bytes to any location accessible by the server process. Additionally, the get user from headers function in dbgpt serve/utils/auth.py grants admin roles regardless of whether a user id header is provided, making the endpoint accessible without credentials. This allows an unauthenticated attacker to place or replace Python modules within the application package, leading to remote code execution when the module is imported.

Recommendations Upgrade dbgpt-app to version 0.8.1.