The vulnerability CVE-2026-101070 in dbgate up to version 7.3.1 is a path traversal issue in the Files Endpoint's runners.js controller. By manipulating the 'runid' parameter, an attacker can traverse directories and access files outside the intended scope. This can be exploited remotely without authentication or user interaction. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality. The vendor was notified but did not provide a fix or response. Public exploit details are available, increasing the risk of exploitation.

Successful exploitation of this vulnerability could allow an attacker to read arbitrary files on the server hosting dbgate, potentially exposing sensitive information. However, the impact on confidentiality is rated low by the CVSS vector, and there is no indication of privilege escalation, integrity, or availability impact. No active exploitation in the wild has been confirmed.

No official patch or remediation is currently available from the vendor. Users should monitor vendor channels for updates. Until a fix is released, restricting access to the affected endpoint and implementing network-level controls to limit exposure may reduce risk. Review and harden file system permissions to minimize potential damage from path traversal attacks.