# DB-GPT v0.8.0 — Unauthenticated arbitrary file write (path traversal / absolute path) — huntr PoC

Private/gated proof-of-concept accompanying a huntr vulnerability report. Access is granted only to the
huntr triage bot.

**Target:** `eosphoros-ai/DB-GPT` @ **v0.8.0** (commit `a3f21350`, latest release).

An unauthenticated `POST /api/v1/python/file/upload` passes the raw multipart filename straight into
`os.path.join(upload_dir, file.filename)` with no sanitization, then `open(file_path,"wb").write(content)`.
An absolute-path filename (`/tmp/evil`) or `../` traversal escapes the intended
`<work_dir>/python_uploads/<user_id>/` confinement and writes attacker-controlled bytes to an
attacker-chosen path — anywhere the DB-GPT service user can write.

## Contents
- `README.md` — this file.
- `REPORT.md` / `POC.md` — the vulnerability report and walkthrough (added separately).
- `poc/fire_005.py` — self-contained deterministic PoC. Run network-isolated:
  ```
  unshare --user --map-root-user --net python3 poc/fire_005.py
  ```
- `poc/vendor/python_upload_api.py` — the real v0.8.0 source file the PoC AST-extracts and executes (the
  `python_file_upload` handler with the untouched `os.path.join` sink), **byte-identical to the released
  PyPI wheel `dbgpt-app==0.8.0`** — sha256 in `poc/PROVENANCE.txt`
  (`7eb363ff…`, verified at runtime).
- `poc/sandbox_005.log` — a recorded run: Oracle A (absolute-path escape) + Oracle B (`..` traversal) +
  NEG-CONTROL (benign filename stays confined) all PASS.

Harmless marker only (short text files, cleaned up); no network egress; the target repository is never
built or installed.