DbGate CVE-2026-101068

Requires a network-reachable dbgate instance (versions up to 7.3.1) whose Create Connection endpoint invokes zipJsonLinesData with an attacker-controlled filePath argument; per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed against a reachable endpoint. The principal limiting factor is deployment exposure: dbgate is commonly run self-hosted and bound to localhost, so practical exploitation depends on the web/API service being exposed on an accessible network interface. This endpoint was NOT covered by the checkSecureExportFilePath hardening (PR #1530 / commit 5f99b4d82, 7.2.5) applied to other export endpoints, and no vendor fix for it is confirmed.

This is a genuine but moderate-severity issue, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes low-complexity remote unauthenticated access, but impact is deliberately constrained to VI:L and VA:L with VC:N - a path-traversal WRITE primitive (the public POC is titled 'dbgate_config_zip_arbitrary_write'), not code execution or data theft, yielding the modest 5.5 base score. Exploitation status: publicly available exploit code exists (POC on GitHub, VulDB E:P Proof-of-Concept), but this is NOT confirmed active exploitation - no KEV listing and no EPSS score were provided, so treat availability of exploit code as distinct from in-the-wild use. A key limiting reality tempers the PR:N rating: dbgate is frequently self-hosted and bound to localhost, so real-world exposure depends on the instance being reachable over the network. Conflicting/incomplete signals to note: the vendor did not respond and no fixed version for THIS endpoint is confirmed - the referenced hardening (PR #1530 / commit 5f99b4d82, 7.2.5, checkSecureExportFilePath) was applied to OTHER export endpoints but explicitly omitted here, so versions up to 7.3.1 appear to remain vulnerable with no vendor patch. Net: a real, low-effort write-primitive worth patching where dbgate is network-exposed, but the limited technical impact and localhost-typical deployment keep it below critical priority.

An attacker who can reach a network-exposed dbgate instance (up to 7.3.1) sends a crafted Create Connection request whose filePath argument contains directory-traversal sequences, causing zipJsonLinesData to write/overwrite a zip file outside the intended export directory. A public proof-of-concept exists demonstrating arbitrary file write (config zip), and because the CVSS vector is PR:N/UI:N/AC:L the request needs no authentication or user interaction against a reachable instance.