Threats affecting pkg:npm/dbgate

CVE-2026-101070 is a path traversal vulnerability in dbgate affecting versions 7.3.0 and 7.3.1. The flaw exists in the Files Endpoint component, specifically in the function handling the 'runid' argument in packages/api/src/controllers/runners.js. This vulnerability allows remote attackers to manipulate the 'runid' parameter to perform path traversal attacks. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity). The vendor was contacted but did not respond, and no patch or fix information is currently available. Public exploit details have been disclosed, but no known exploits in the wild have been reported.

A weakness has been identified in dbgate up to 7.3.1. Affected is the function exportModelSql of the file packages/api/src/controllers/databaseConnections.js of the component Export Handler. Executing a manipulation of the argument outputFile can lead to path traversal. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

A security flaw has been discovered in dbgate up to 7.3.1. This impacts the function zipJsonLinesData of the file packages/api/src/utility/zipJsonLinesData.js of the component Create Connection Endpoint. Performing a manipulation of the argument filePath results in path traversal. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. PR #1530 / commit 5f99b4d82 (7.2.5) hardened other export endpoints with checkSecureExportFilePath but omitted this endpoint. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-101067 is a path traversal vulnerability in dbgate affecting multiple versions up to 7.3.1. It involves the saveUploadedFile function in files.js, where manipulation of filePath or fileName parameters can lead to unauthorized file system access. The vulnerability can be exploited remotely without authentication. Public exploit code is available, but no vendor response or patch has been provided.

A vulnerability was determined in dbgate up to 7.3.1. The impacted element is the function createLink of the file packages/api/src/controllers/archive.js of the component Archive Link Creation. This manipulation of the argument linkedFolder causes path traversal. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

A weakness has been identified in DbGate up to 7.1.4. The impacted element is the function apiServerUrl1 of the file packages/rest/src/openApiDriver.ts of the component REST/GraphQL. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.