CVE-2026-80104: DB-GPT Skill Upload Path Traversal (and Sibling CVE-2026-73034)

Dev.to•Mon, Aug 31, 2026, 04:47 AM•2 min read

Originally published at HOL CVE-2026-80104: DB-GPT skill upload writes past the upload directory Two different unauthenticated path-traversal arbitrary file writes hit DB-GPT upload APIs. CVE-2026-80104 is the skill-upload multipart filename bug in agentic_data_api. py .

Source: [Dev.to](https://dev.to/hol/cve-2026-80104-db-gpt-skill-upload-path-traversal-and-sibling-cve-2026-73034-d56)

📰 Read Full Story

This is an aggregated headline summary. For the complete report, visit the original publisher.

Continue Reading at Dev.to ↗

#tech #upload #user #python #api #cve #skill #filename #pypi

More Headlines

TechnologyHacker News• 8m ago

Design Considerations for an Anthropophilic Computer (1979)

1 points, 0 comments on Hacker News

TechnologyHacker News• 8m ago

ElephpantDB: A pure PHP SQL database

1 points, 0 comments on Hacker News

TechnologyBusiness Insider• 12m ago

Ukrainians slapped twin AK rifles on a drone with wheels to make a cheap mobile turret

Kyiv has been looking to cheaper assault drones that it can scale rapidly to reduce the risks to its infantry.

TechnologyBusiness Insider• 13m ago

Google is getting flak for changing Lake Ontario's name to Lake America

Canadian politicians are also scrubbing government websites that embed Google Maps to ensure the lake is labeled Lake Ontario.

TechnologyDev.to• 13m ago

BREAKING: CVE-2026-18500 - @fastify/jwt Key Override Authorization Bypass

Originally published at HOL BREAKING: CVE-2026-18500 - @fastify/jwt key override authorization bypass TL;DR: CVE-2026-18500 affects @fastify/jwt versions before 10. 2. 2.

TechnologyDev.to• 15m ago

28 Hours of Green Logs, Zero Replies: How a Single `echo` Line Swallowed Every Exit Code

For 24 hours, every dashboard was green. Every launchd job reported exit 0 , and the logs lined up neatly with (exit 0) on every row. Meanwhile, DM replies on X (formerly Twitter) were at zero for the entire day, and YouTrust was the same.