A critical path traversal vulnerability in eosphoros-ai DB-GPT allows unauthenticated attackers to achieve remote code execution on affected servers.

The application fails to sanitize filenames during skill uploads, permitting directory traversal. Because the authentication middleware incorrectly grants administrative access to unauthenticated requests, an attacker can upload malicious Python files to arbitrary locations and trigger code execution.

Successful exploitation grants an attacker full control over the server process, leading to a complete compromise of the underlying host. This poses a severe risk of data theft, lateral movement within the network, and total service disruption, warranting immediate remediation given the CVSS score of 9.8.

Immediate Action: Update eosphoros-ai DB-GPT to version 0.8.1 or later immediately.

Proactive Monitoring: Review application logs for unusual file upload requests or unauthorized attempts to access Python scripts in unexpected directories.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block file upload requests containing directory traversal sequences, such as dot-dot-slash patterns.

Public Exploit Available: Unknown

This is a critical security flaw that requires urgent attention. Administrators must prioritize updating the DB-GPT installation to the patched version, as the lack of authentication requirements makes this vulnerability highly susceptible to automated scanning and exploitation.