This vulnerability affects dbgate up to version 7.3.1 in the zipJsonLinesData function of packages/api/src/utility/zipJsonLinesData.js, specifically in the Create Connection Endpoint component. An attacker can manipulate the filePath argument to perform path traversal, potentially accessing unauthorized files. Although other export endpoints were hardened in version 7.2.5, this endpoint was omitted. The exploit has been publicly released, increasing the risk of attack. The vendor has not provided any response or patch to date.

Successful exploitation allows an unauthenticated remote attacker to perform path traversal via the filePath argument, potentially accessing or manipulating files outside the intended directory. This could lead to information disclosure or other impacts depending on the environment and usage. The CVSS 4.0 score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and limited impact on confidentiality and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, avoid exposing the vulnerable endpoint to untrusted networks or restrict access to trusted users only.