A critical unauthenticated path traversal vulnerability in DB-GPT allows remote attackers to achieve remote code execution by writing arbitrary files to the server.

The application suffers from improper path validation (CWE-22) in the file-upload endpoint. An unauthenticated attacker can inject directory traversal sequences into the user_id HTTP header to escape the designated upload directory and overwrite sensitive system files.

The ability to write arbitrary files to the server, such as startup hooks or configuration files, results in full remote code execution. With a CVSS score of 9.8, this vulnerability allows total system compromise, leading to complete loss of confidentiality, integrity, and availability for the affected host.

Immediate Action: Apply the vendor-provided patch or update to the latest version identified in the project repository.

Proactive Monitoring: Monitor server logs for suspicious HTTP requests containing directory traversal sequences, such as dot-dot-slash patterns, directed at file-upload endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block requests containing path traversal sequences in headers.

Public Exploit Available: Unknown

This is a critical vulnerability that requires immediate attention. Because it allows unauthenticated remote code execution, it should be treated as a top-priority remediation item. Ensure all public-facing instances are protected until updates are verified and applied.