DbGate CVE-2026-101067

Requires network access to the dbgate save-uploaded-file endpoint (files.js, saveUploadedFile function) and the ability to control the filePath/fileName argument in an upload request. Per the vendor's CVSS vector no authentication is required (PR:N) and no user interaction is needed, but this is unverified - many dbgate deployments sit behind authentication, which would raise the effective privilege requirement. Practical exploitation is limited to instances where the upload endpoint is reachable by the attacker (exposed web UI or accessible internal network); air-gapped or auth-gated deployments substantially reduce risk.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, all impacts Low, base 5.5) describes a remotely reachable, low-complexity, unauthenticated path-traversal requiring no user interaction. The E:P (Proof-of-Concept) exploit-maturity flag aligns with the confirmed public POC on GitHub, so exploit code demonstrably exists. There is no EPSS score, no SSVC decision data, and no CISA KEV listing provided, so there is no evidence of active exploitation - this is publicly-exploitable but not confirmed in-the-wild. The vendor's uniform VC:L/VI:L/VA:L rating is arguably conservative: a path-traversal in a file-*upload* handler (saveUploadedFile writing attacker-controlled filePath/fileName) is typically an arbitrary-file-*write* primitive, which can escalate to configuration overwrite or code execution and warrants a higher integrity impact than 'Low.' Net: a real, low-effort issue on internet-exposed instances, but the modest deployment footprint and lack of active-exploitation signals keep it below top-tier priority. Note conflict to verify: the vendor asserts unauthenticated remote access (PR:N), yet dbgate is commonly deployed behind a login - confirm whether the save-uploaded-file endpoint is reachable pre-authentication in the target deployment.

An attacker reaches an internet-exposed or LAN-accessible dbgate instance and sends a crafted request to the save-uploaded-file endpoint with a filePath/fileName containing traversal sequences (e.g. ../../). The uploaded file is written outside the intended directory, allowing overwrite of application or system files. A public POC exists (github.com/0xGenesi/CVE), lowering the skill required to weaponize this.