EUVD-2026-88235
GHSA-q4gc-mhjr-mx2r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed dbgate API
-
DeliverySend createLink request with malicious linkedFolder
-
ExploitTraverse outside archive directory
-
ExecutionAccess/link unintended filesystem paths
-
ImpactLimited file disclosure or manipulation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a reachable dbgate API/web server (version up to 7.3.1) with the Archive functionality accessible, and the attacker must be able to submit an Archive Link Creation (createLink) request supplying an attacker-controlled linkedFolder value. Per CVSS PR:N/UI:N, no authentication or user interaction is modeled. The primary LIMITING factor is exposure: dbgate is commonly deployed as a local or internal developer tool rather than an internet-facing service, so real-world reachability by an unauthenticated remote attacker is the main gate on exploitation, and impact is bounded by the server process's filesystem permissions. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated path traversal with only low technical impact across confidentiality, integrity and availability (VC:L/VI:L/VA:L), yielding a 6.9 (Medium) score. The E:P (Proof-of-Concept) exploit maturity aligns with the reported public POC on GitHub (0xGenesi) and VulDB entry 410924 - so exploit code exists, but there is NO EPSS score, NO CISA KEV listing, and no evidence of active exploitation. This is publicly available exploit code, NOT confirmed in-the-wild use, so it is a moderate-priority issue rather than an emergency. A key caveat: dbgate is primarily a developer-facing database client that is frequently run locally or on a trusted internal host; the PR:N/AV:N rating assumes the web/API server mode is network-exposed, which is not the typical default deployment - verify actual exposure before prioritizing. The vendor was contacted and did not respond, and no fixed version is confirmed, which increases residual risk for any internet-exposed instances. |
| Exploit ScenarioDerived | An attacker who can reach an exposed dbgate API server sends a crafted Archive Link Creation request to the createLink function with a linkedFolder value containing directory-traversal sequences (e.g. ../../), causing the server to reference files or folders outside the intended archive directory. A public proof-of-concept exists (GitHub 0xGenesi), lowering the skill needed to reproduce it. Given AV:N/AC:L/PR:N, the request requires no authentication or user interaction against a reachable instance. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Unauthenticated remote path traversal in DbGate through 7.3.1 allows attackers to manipulate the linkedFolder argument in the Archive Link Creation createLink endpoint and access paths outside the intended archive link location. Publicly available exploit code exists, and the vendor was contacted but did not respond; exploitation is limited mainly by whether the DbGate web/API service is reachable by the attacker and by the filesystem privileges of the DbGate process. The assessed impact is low against confidentiality, integrity, and availability (CVSS 3.1 C:L/I:L/A:N; CVSS 4.0 6.9 Medium).
RemediationAI
No vendor-released patch identified at time of analysis, and the vendor reportedly did not respond to the disclosure. Until a fixed version is available, immediately restrict network access to the DbGate API/web interface: bind it to localhost or a trusted management network, block external access to the Archive endpoints, and avoid exposing DbGate to the internet. If archive-link creation is not required, disable the Archive Link Creation feature or remove access to the createLink functionality; this breaks archive link creation but removes the vulnerable code path. Administrators who must keep it enabled should add server-side authorization and strict validation that canonicalizes linkedFolder and rejects paths outside an allow-listed archive root, and run DbGate with least filesystem privilege to limit traversal impact. Given publicly available exploit code, prioritize detection of ../ or absolute-path sequences in linkedFolder requests and review the advisories at https://vuldb.com/vuln/410924 and the exploit reference https://github.com/0xGenesi/CVE/blob/main/dbgate_archive_link_path_traversal.md.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
DbGate is a database management tool implemented with Node.js API controllers; the vulnerable code is createLink in packages/api/src/controllers/archive.js in the Archive Link Creation component. The function fails to properly validate or canonicalize the linkedFolder argument before using it, a CWE-22 path traversal condition that permits ../ sequences or otherwise crafted paths to escape the intended directory. The CVSS vectors show network reachability with no privileges or user interaction (PR:N/UI:N), while the affected CPE cpe:2.3:a:n/a:dbgate:*:*:*:*:*:*:*:* points to the DbGate product broadly, with versions up to 7.3.1 identified as impacted. The primary limitation is deployment exposure: many DbGate instances are local or internal developer tools, and file impact is bounded by the permissions of the DbGate server process.
Know when Dbgate gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable, low-complexity, unauthenticated per vendor; path traversal gives limited file read/write (C:L/I:L), no availability impact, and no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was determined in dbgate up to 7.3.1. The impacted element is the function createLink of the file packages/api/src/controllers/archive.js of the component Archive Link Creation. This manipulation of the argument linkedFolder causes path traversal. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Path traversal in DbGate 7.3.1 and earlier allows unauthenticated remote attackers to read arbitrary files from the serv
Path traversal in DbGate versions up to 6.8.1, 7.0.2, 7.1.8, 7.2.5, and 7.3.1 allows remote attackers to write files out
Path traversal in DbGate versions up to 7.3.1 allows unauthenticated remote attackers to write arbitrary files via the o
Path traversal in DbGate versions up to 7.3.1 allows unauthenticated remote attackers to write arbitrary files via the C
Arbitrary file read and write in DbGate through version 7.2.6 allows authenticated low-privilege users to escape the app
Code injection in DbGate (a web-based database GUI) versions up to 7.2.5-beta.5 lets an authenticated user who can creat
Authenticated path traversal in DbGate's files-style API endpoint lets a low-privileged remote user read files outside t
Server-side request forgery in DbGate versions 7.1.0 through 7.1.4 allows authenticated remote attackers to manipulate t
Cross-site scripting in DbGate's SVG Icon String Handler allows a remote authenticated attacker to inject malicious scri
Exploit-DB