CVE-2026-101067 in dbgate
Summary
by MITRE • 09/28/2026
A vulnerability was identified in dbgate up to 6.8.1/7.0.2/7.1.8/7.2.5/7.3.1. This affects the function saveUploadedFile of the file files.js of the component save-uploaded-file Endpoint. Such manipulation of the argument filePath/fileName leads to path traversal. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/28/2026
The vulnerability identified in dbgate versions up through 6.8.1, 7.0.2, 7.1.8, 7.2.5, and 7.3.1 represents a critical security flaw within the application's file handling mechanisms. Specifically, this issue resides in the saveUploadedFile function located in the files.js module, which is invoked by the save-uploaded-file endpoint. This component is responsible for processing user-submitted files, yet it fails to adequately sanitize or validate the input arguments filePath and fileName before using them to construct filesystem paths. The absence of rigorous validation allows an attacker to manipulate these parameters to include directory traversal sequences, such as dot-dot-slash characters, which are interpreted by the underlying operating system rather than being treated as literal filename components. This fundamental lack of input sanitization is a classic example of improper restriction of path canonicalization errors, allowing external actors to bypass intended access controls and write files to arbitrary locations on the server's filesystem.
From an operational perspective, this vulnerability enables remote attackers to achieve unauthorized file writes with potentially severe consequences for system integrity and confidentiality. Because the exploit is publicly available, automated attacks targeting known vulnerable instances are highly probable in real-world scenarios. An attacker could leverage this flaw to overwrite critical application configuration files, inject malicious scripts into web-accessible directories to facilitate cross-site scripting or remote code execution, or place backdoors within sensitive system paths. The impact extends beyond simple data corruption; it can lead to complete compromise of the underlying server if the dbgate process runs with elevated privileges or if the written file is subsequently executed by another service. This aligns closely with CWE-22, which defines Improper Limitation of a Pathname to a Restricted Directory, and maps directly to MITRE ATT&CK technique T1059, specifically Command Scripting or File Manipulation depending on the payload delivered via the path traversal vector.
The severity of this issue is further compounded by the vendor's lack of response to early disclosure attempts. In standard security practices, timely patching is essential for mitigating risks associated with publicly disclosed vulnerabilities. The absence of a vendor-provided fix forces administrators and users to rely on workarounds or manual code modifications to secure their deployments. This situation highlights the importance of maintaining up-to-date software versions from responsive vendors who prioritize security hygiene. Organizations running affected versions should immediately assess their exposure by checking for any unauthorized file changes in web directories or sensitive system paths. Mitigation strategies include implementing strict input validation on all file upload endpoints, enforcing allowlists for permitted characters and directory structures, and utilizing chroot jails or containerization to limit the blast radius of potential filesystem access violations until an official patch is released.