CVE-2026-73034 describes a critical unauthenticated path traversal vulnerability in eosphoros-ai's DB-GPT version 0.8.1. Attackers can exploit this by sending a crafted multipart upload request with directory traversal sequences in the user_id HTTP header to escape the intended upload directory. This allows arbitrary file writes to any location on the server, including sensitive locations like Python startup hooks, cron directories, or agent scripts, enabling remote code execution.

Successful exploitation allows remote attackers to write arbitrary files to any location on the server without authentication, potentially leading to remote code execution. This compromises server integrity and confidentiality, enabling full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoint and monitor for suspicious multipart upload requests with unusual user_id headers.