| 제목 | dbgate <= 7.2.5 Path Traversal |
|---|
| 설명 | A vulnerability was found in dbgate/dbgate up to 7.2.5 and classified as problematic. The runners/files endpoint accepts a runid parameter without UUID or path validation. Supplying traversal sequences such as ../../../../etc causes the application to list the contents of arbitrary directories on the server filesystem, disclosing file names, sizes and absolute paths. This information can be used to identify sensitive files for subsequent attacks using companion file read or write vulnerabilities in the same application. The default anonymous deployment requires no authentication. The attack can be launched remotely. The CVSS base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). |
|---|
| 원천 | ⚠️ https://github.com/0xGenesi/CVE/blob/main/dbgate_runners_files_path_traversal.md |
|---|
| 사용자 | chenhuanlin (UID 100424) |
|---|
| 제출 | 2026. 08. 14. AM 08:58 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 27. PM 07:01 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 410928 [dbgate 까지 7.3.1 Files Endpoint runners.js files runid 디렉토리 순회] |
|---|
| 포인트들 | 20 |
|---|