This vulnerability in dbgate up to version 7.3.1 involves the exportModelSql function in packages/api/src/controllers/databaseConnections.js. By manipulating the outputFile parameter, an attacker can perform a path traversal attack remotely, potentially accessing or overwriting files outside the intended directory. The vulnerability has been publicly disclosed with exploit code available. The vendor has not provided a response or patch as of the publication date.

Successful exploitation allows an unauthenticated remote attacker to perform path traversal via the outputFile argument in the exportModelSql function. This could lead to unauthorized access or modification of files on the server running dbgate. The CVSS score of 6.9 indicates a medium impact with no privileges or user interaction required.

No official patch or remediation has been provided by the vendor, and the vendor has not responded to the disclosure. Users should monitor vendor channels for updates. Until a fix is available, restricting access to the vulnerable function or limiting exposure of the dbgate service to untrusted networks may reduce risk.