What happened
NVD published CVE-2026-73034 (CVSS 9.8, Critical) on 2026-08-11, confirmed via NVD change-history record dated 2026-08-11.
Why it matters
DB-GPT is an open-source AI agent framework for database interaction; unauthenticated arbitrary file write on the server can lead directly to remote code execution (e.g., writing web shells or overwriting application code), fully compromising the AI agent's host.
Attack vector
Remote unauthenticated attacker injects directory-traversal sequences into the user_id HTTP header of the Python file-upload endpoint, writing arbitrary files to any server location via a crafted multipart upload request.
Affected systems
DB-GPT v0.8.1
Mitigation
Apply vendor patch when available; sanitize/validate user_id header input; restrict file-upload endpoint write paths.