This vulnerability in DbGate up to versions 7.2.5 and 7.3.1-premium-beta.1 allows remote attackers to perform path traversal via manipulation of the filePath/uri argument in the fs.readFile function within packages/api/src/controllers/files.js. This enables unauthorized reading of files outside the intended directory scope. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity) with network attack vector, low attack complexity, and no user interaction required. The vendor has not provided any response or patch information.

Successful exploitation could allow an attacker with low privileges to read arbitrary files on the server remotely, potentially exposing sensitive information. The impact is limited to information disclosure as per the CVSS vector and description.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider restricting access to the vulnerable endpoint and monitor for suspicious activity involving file read requests until an official patch is available.