CVE-2026-101068
dbgate Create Connection Endpoint zipJsonLinesData.js zipJsonLinesData path traversal
- State
- Published
- Severity
- 6.9 Medium
- Published
- Sep 28, 2026
- Updated
- Sep 28, 2026
- Reserved
- Sep 27, 2026
Description
A security flaw has been discovered in dbgate up to 7.3.1. This impacts the function zipJsonLinesData of the file packages/api/src/utility/zipJsonLinesData.js of the component Create Connection Endpoint. Performing a manipulation of the argument filePath results in path traversal. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. PR #1530 / commit 5f99b4d82 (7.2.5) hardened other export endpoints with checkSecureExportFilePath but omitted this endpoint. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C | VulDB |
| 3.0 | 6.5 Medium | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C | VulDB |
| 2.0 | 6.4 Medium | AV:N/AC:L/Au:N/C:N/I:P/A:P/E:POC/RL:ND/RC:C | VulDB |
Weaknesses
- CWE-22 Path Traversal
Affected Products
| Product | Versions |
|---|---|
dbgaten/a |
|
References
- VDB-410926 | dbgate Create Connection Endpoint zipJsonLinesData.js zipJsonLinesData path traversalvdb-entrytechnical-description
- VDB-410926 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-101068 | CVE Analysis and Reportthird-party-advisory
- Submit #929031 | dbgate <= 7.2.5 Path Traversalthird-party-advisory
- https://github.com/0xGenesi/CVE/blob/main/dbgate_config_zip_arbitrary_write.mdexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.