External risk intelligence

DB-GPT Directory Traversal Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-51863

The vulnerability exists in an openapi endpoint (examples_api.py) within an application framework designed for LLM interactions and data management. Such applications are commonly deployed as web-based interfaces or APIs exposed to users or the internet to facilitate data access and interaction, making the reachable surface likely.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A directory traversal vulnerability has been identified in DB-GPT, a system for interacting with large language models and managing data. This flaw could allow unauthorized file writing, potentially impacting the integrity of your data environment. The primary concern at this stage is to confirm if this technology is in use and assess the scope of any potential exposure.

Attackers can write files anywhere on the system.
Confirms relevance and exposure to sensitive data.
Assess usage and potential impact on data integrity.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to the API. This would allow them to write files to locations on the server that are outside of the intended storage area, potentially leading to the compromise of sensitive information or the execution of malicious code.

Network access required, no authentication needed.
API endpoint accepts user-supplied file paths.
Allows writing files outside designated areas.

Live Threat

Current exploitation, exposure, and threat context

A directory traversal vulnerability in DB-GPT could allow a remote attacker to write files outside of designated storage areas. This could affect the integrity of the application's file system and potentially impact the availability of legitimate files when supported by the advisory.

Application files.
Remote file write to unintended locations.
System instability or data corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

DB-GPT's directory traversal vulnerability necessitates action from the application owner responsible for the DB-GPT deployment. The initial step is to locate all instances of DB-GPT, assess their reachability and criticality, identify the specific team accountable for that instance, and then prioritize remediation efforts based on risk.

Application owners should manage this.
Verify current DB-GPT instances and exposure.
Plan risk-based remediation and vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is DB-GPT and what is it used for?

DB-GPT is an open-source framework designed to help developers build applications that integrate large language models with private data. It acts as an orchestration layer, allowing users to interact with databases and local files through natural language queries. Organizations typically use it to create data-driven LLM assistants that manage, analyze, and retrieve information from internal storage.

What does directory traversal mean for CVE-2026-51863?

This vulnerability is classified as Improper Limitation of a Pathname, or directory traversal (CWE-22). It means the software fails to properly sanitize input paths provided by a user. Because of this, an attacker can manipulate file paths to escape the application's intended directory, allowing them to write or overwrite files anywhere on the server's file system that the application has permissions to access.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending a specially crafted request to the specific API endpoint responsible for handling example files. The vulnerability does not require authentication, meaning an attacker can attempt this without logging in. Importantly, this flaw is specific to the handling of user-supplied paths in the API; standard interactions that do not involve passing file path parameters are not affected by this specific path traversal mechanism.

Do I need to worry if my DB-GPT instance is internal?

According to Halo Surface Signal, this vulnerability resides in an API endpoint commonly deployed as a web interface, making it reachable if exposed to a network. While external-facing instances are at higher risk, you should still care if your instance is internal. If an attacker gains a foothold in your network, they could reach the API and exploit it, regardless of whether it is directly on the public internet.

How should I respond if I am running DB-GPT?

Your first step is to identify where DB-GPT is running in your environment and who is responsible for those instances. Once located, assess the network reachability of these deployments to understand your risk. Since this is an application-layer issue, coordinate with your development or operations teams to verify if you are using the affected versions and prioritize a path for updates or configuration changes once official guidance becomes available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.