जमा करें #908139: DbGate dbgate <= 7.2.4-packer-beta.3 Path Traversal

Authenticated arbitrary file write and arbitrary file read in DbGate through unsafe server-side path handling in /files endpoints.

DbGate / dbgate up to 7.2.4-packer-beta.3 is affected by authenticated arbitrary file write and arbitrary file read vulnerabilities in multiple web-exposed /files endpoints. The issue is caused by trusting client-controlled filesystem paths and passing them directly to server-side filesystem operations without enforcing a safe base directory, path normalization boundary, or equivalent server-side validation.

Affected component:

packages/api/src/controllers/files.js

Affected endpoints include:

POST /files/export-diagram-png
POST /files/export-chart
POST /files/export-map
POST /files/export-diagram
POST /files/export-file
POST /files/download-text

The most serious write primitive is reachable through /files/export-diagram-png. This endpoint accepts a client-controlled filePath and client-controlled base64 content, then writes the decoded bytes directly to the supplied server-side path. Related export endpoints follow the same unsafe pattern by writing exported content to a client-controlled filePath.

This allows an authenticated attacker to write attacker-controlled content to arbitrary filesystem locations writable by the DbGate process. The impact depends on deployment permissions and filesystem layout. In the tested Docker deployment, this was confirmed by writing attacker-controlled content into DbGate's public web directory and serving it from the DbGate origin.

The issue also exposes authenticated arbitrary file read primitives. In /files/download-text, when the supplied uri is not handled as an HTTP, HTTPS, or ZIP resource, the value can be treated as a local filesystem path and passed to fs.readFile. In the tested Docker deployment, this was confirmed by reading /etc/passwd through /files/download-text. This allows an authenticated attacker to read local files accessible to the DbGate process.

A second file read primitive exists in /files/export-file. The source path is built from client-controlled folder and file values. Because these values are not restricted to the intended DbGate files directory with the same validation pattern used by safer file operations, an attacker can use path traversal to copy files readable by the Node.js process into an application-readable location and retrieve them through the legitimate /files/load API. In the tested Docker deployment, this was confirmed by copying /etc/passwd into an application-readable location and retrieving it through /files/load.

Impact:

An authenticated attacker can read and write server-side files within the permissions of the DbGate process. This may allow disclosure of sensitive local files, access to configuration or connection material, modification of web-accessible content, data corruption, denial of service, or further compromise depending on deployment configuration, file permissions, and mounted volumes.

This issue is distinct from previously disclosed DbGate path traversal or file access issues. It affects different web-exposed /files endpoints in packages/api/src/controllers/files.js, specifically exportDiagramPng/exportChart/exportMap/exportDiagram, exportFile, and downloadText.

Suggested vulnerability class:

Path Traversal / Arbitrary File Read and Write

Suggested CWE:

Primary: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory
Related: CWE-73 - External Control of File Name or Path

Suggested CVSS v3.1:

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 High

Vendor contact:

The vendor was contacted through GitHub Security Advisory. No vendor response, CVE assignment, or patched version is known at the time of this submission.

• उपयोगकर्ता: ZsZsec (UID 100174)
• सबमिशन: 28/07/2026 11:02 PM (2 महीनों पहले)
• संयम: 24/09/2026 11:53 AM (2 months later)
• स्थिति: स्वीकृत
• VulDB प्रविष्टि: 409320 [DbGate तक 7.2.5/7.3.1-premium-beta.1 files-style Endpoint files.js fs.readFile filePath/uri निर्देशिका ट्रैवर्सल]
• अंक: 17