CVE-2026-101067

A weakness has been identified in dbgate up to 7.3.1 in the exportModelSql function of packages/api/src/controllers/databaseConnections.js (Export Handler component). Manipulating the outputFile argument leads to path traversal, and the attack can be executed remotely. The exploit has been made publicly available and could be used for attacks.

A security flaw has been discovered in dbgate up to 7.3.1 in the zipJsonLinesData function of packages/api/src/utility/zipJsonLinesData.js (Create Connection Endpoint component). Manipulating the filePath argument results in path traversal, and remote exploitation is possible. The exploit has been released to the public and may be used for attacks.

A vulnerability was determined in dbgate up to 7.3.1 affecting the createLink function in packages/api/src/controllers/archive.js of the Archive Link Creation component. Manipulation of the linkedFolder argument causes path traversal.

DbGate versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized functionName parameter in the /runners/load-reader endpoint. The require = null mitigation is trivially bypassed via dynamic import(). Version 7.1.9 contains a patch.

In DbGate, the unzipDirectory() function does not validate extracted file paths, allowing path traversal. In default Docker deployment, a network attacker can exploit this to execute arbitrary code as root.

DbGate, a cross-platform database manager, in versions 7.1.8 and prior contains a remote code execution vulnerability in the JSON script runner (POST /runners/start). Code injection occurs via the functionName parameter in JSON script assign commands, which is interpolated directly into dynamically generated JavaScript code. The code is executed in a forked Node.js child process. Version 7.1.9 contains a patch.

A security vulnerability has been detected in dbgate up to 7.3.1, affecting the function files in packages/api/src/controllers/runners.js of the Files Endpoint component. Manipulation of the runid argument leads to path traversal. The attack is possible remotely and the exploit has been publicly disclosed.

DbGate up to version 7.2.5/7.3.1-premium-beta.1 has a path traversal vulnerability in the fs.readFile function in packages/api/src/controllers/files.js. Manipulation of the filePath/uri arguments allows an attacker to remotely read arbitrary files outside the allowed directory.

A code injection vulnerability was found in DbGate up to version 7.2.5-beta.5 in the JSON Runner component. Manipulating the comment.text/script.schedule arguments in packages/api/src/controllers/runners.js can lead to remote code execution. Upgrading to version 7.2.5-beta.6 mitigates the issue.

DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName() to bypass directory containment and access sensitive files including encrypted database credentials stored in connections configuration.