CVE-2026-101069
MediumCVSS 6.5Summary
A weakness has been identified in dbgate up to 7.3.1 in the exportModelSql function of packages/api/src/controllers/databaseConnections.js (Export Handler component). Manipulating the outputFile argument leads to path traversal, and the attack can be executed remotely. The exploit has been made publicly available and could be used for attacks.
Risk Assessment
An attacker can remotely write files outside the intended directory, potentially overwriting system files or achieving code execution. The vendor was contacted but did not respond.
Recommendation
Restrict access to the dbgate interface to trusted networks and consider applying patches as soon as they become available. Monitor for unusual export operations and validate output file paths.
Other vulnerabilities in dbgate
See all- CVE-2026-101068Medium
A security flaw has been discovered in dbgate up to 7.3.1 in the zipJsonLinesData function of packages/api/src/utility/zipJsonLinesData.js (Create Connection Endpoint component). Manipulating the filePath argument results in path traversal, and remote exploitation is possible. The exploit has been released to the public and may be used for attacks.
- CVE-2026-101066High
A vulnerability was determined in dbgate up to 7.3.1 affecting the createLink function in packages/api/src/controllers/archive.js of the Archive Link Creation component. Manipulation of the linkedFolder argument causes path traversal.
- CVE-2026-47670Critical
DbGate versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized functionName parameter in the /runners/load-reader endpoint. The require = null mitigation is trivially bypassed via dynamic import(). Version 7.1.9 contains a patch.
- CVE-2026-47669Critical
In DbGate, the unzipDirectory() function does not validate extracted file paths, allowing path traversal. In default Docker deployment, a network attacker can exploit this to execute arbitrary code as root.
- CVE-2026-47668Critical
DbGate, a cross-platform database manager, in versions 7.1.8 and prior contains a remote code execution vulnerability in the JSON script runner (POST /runners/start). Code injection occurs via the functionName parameter in JSON script assign commands, which is interpolated directly into dynamically generated JavaScript code. The code is executed in a forked Node.js child process. Version 7.1.9 contains a patch.
- CVE-2026-101070Medium
A security vulnerability has been detected in dbgate up to 7.3.1, affecting the function files in packages/api/src/controllers/runners.js of the Files Endpoint component. Manipulation of the runid argument leads to path traversal. The attack is possible remotely and the exploit has been publicly disclosed.
- CVE-2026-101067High
A vulnerability was identified in dbgate up to 6.8.1/7.0.2/7.1.8/7.2.5/7.3.1 affecting the saveUploadedFile function in files.js of the save-uploaded-file Endpoint component. Manipulation of the filePath/fileName argument leads to path traversal.
- CVE-2026-97226Medium
DbGate up to version 7.2.5/7.3.1-premium-beta.1 has a path traversal vulnerability in the fs.readFile function in packages/api/src/controllers/files.js. Manipulation of the filePath/uri arguments allows an attacker to remotely read arbitrary files outside the allowed directory.
- CVE-2026-97225Medium
A code injection vulnerability was found in DbGate up to version 7.2.5-beta.5 in the JSON Runner component. Manipulating the comment.text/script.schedule arguments in packages/api/src/controllers/runners.js can lead to remote code execution. Upgrading to version 7.2.5-beta.6 mitigates the issue.
- CVE-2026-85176High
DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName() to bypass directory containment and access sensitive files including encrypted database credentials stored in connections configuration.
Original NVD description (English source)
A weakness has been identified in dbgate up to 7.3.1. Affected is the function exportModelSql of the file packages/api/src/controllers/databaseConnections.js of the component Export Handler. Executing a manipulation of the argument outputFile can lead to path traversal. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS