CVE-2026-51864

Summary

This flaw allows a remote attacker to perform directory traversal and write files outside the intended workspace, leading to potential data leakage or system compromise.

Exploitability

Exploitation is relatively straightforward given the validated path, requiring only the ability to upload a file through the API.

Blast radius

If exploited, the attacker could write sensitive files to critical system directories, leading to data breaches or system instability.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to DB-GPT v0.8.1 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.