CVE-2026-97226
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
DbGate up to version 7.2.5/7.3.1-premium-beta.1 has a path traversal vulnerability in the fs.readFile function in packages/api/src/controllers/files.js. Manipulation of the filePath/uri arguments allows an attacker to remotely read arbitrary files outside the allowed directory.
Risk Assessment
A remote attacker can gain access to sensitive files on the system, potentially leading to data leakage or further server compromise.
Recommendation
Restrict access to the service, validate and sanitize path arguments, and monitor the vendor for updates as they have not responded to the disclosure.
Other vulnerabilities in DbGate
See all- CVE-2026-47670Critical
DbGate versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized functionName parameter in the /runners/load-reader endpoint. The require = null mitigation is trivially bypassed via dynamic import(). Version 7.1.9 contains a patch.
- CVE-2026-47669Critical
In DbGate, the unzipDirectory() function does not validate extracted file paths, allowing path traversal. In default Docker deployment, a network attacker can exploit this to execute arbitrary code as root.
- CVE-2026-47668Critical
DbGate, a cross-platform database manager, in versions 7.1.8 and prior contains a remote code execution vulnerability in the JSON script runner (POST /runners/start). Code injection occurs via the functionName parameter in JSON script assign commands, which is interpolated directly into dynamically generated JavaScript code. The code is executed in a forked Node.js child process. Version 7.1.9 contains a patch.
- CVE-2026-97225Medium
A code injection vulnerability was found in DbGate up to version 7.2.5-beta.5 in the JSON Runner component. Manipulating the comment.text/script.schedule arguments in packages/api/src/controllers/runners.js can lead to remote code execution. Upgrading to version 7.2.5-beta.6 mitigates the issue.
- CVE-2026-85176High
DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName() to bypass directory containment and access sensitive files including encrypted database credentials stored in connections configuration.
- CVE-2026-48017High
DbGate is a cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reader endpoint interpolates the functionName parameter directly into a JavaScript code template without sanitization. An authenticated user can inject arbitrary JavaScript code that executes on the server with full Node.js process privileges, bypassing sandbox restrictions.
- CVE-2026-34725High
DbGate versions 7.0.0 through 7.1.4 have a stored XSS vulnerability because attacker-controlled SVG icons are rendered as raw HTML without sanitization. In the web UI this allows script execution in another user's browser; in the Electron desktop app it can escalate to local code execution.
Original NVD description (English source)
A vulnerability has been found in DbGate up to 7.2.5/7.3.1-premium-beta.1. This impacts the function fs.readFile of the file packages/api/src/controllers/files.js of the component files-style Endpoint. The manipulation of the argument filePath/uri leads to path traversal. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS