DbGate CVE-2026-101069

Requires network reachability to a dbgate instance (<=7.3.1) whose backend API exposes the model-SQL export functionality (exportModelSql). The attacker must be able to supply the outputFile parameter with traversal sequences to the Export Handler. The CVSS vector rates this PR:N/UI:N (no authentication or user interaction), but realistic exploitation is limited to deployments where the dbgate API is network-exposed and not protected by authentication or bound only to localhost - self-hosted/multi-user web deployments are the primary at-risk configuration. Impact is constrained to writing SQL-export content, so full code execution depends on writing to a sensitive/executable path.

This is a genuine but moderate-severity issue best treated as medium-low priority. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:N/VI:L/VA:L) scores 5.5 and describes a remotely reachable, low-complexity path traversal in dbgate's export handler yielding limited integrity and availability impact (arbitrary file write of SQL-model export content), with no confidentiality impact. Signals are mostly consistent: a public exploit exists (E:P and a GitHub PoC titled 'dbgate_export_model_sql_arbitrary_write.md', confirming arbitrary WRITE rather than read), but there is NO EPSS score provided and the CVE is NOT on CISA KEV, so there is no evidence of active exploitation - only publicly available exploit code. The main tension is the PR:N (unauthenticated) rating: dbgate is a database management tool whose API/web deployments are frequently protected by login or bound to localhost, so real-world unauthenticated exposure depends heavily on how the instance is deployed - verify whether the target dbgate exposes the API without authentication. Impact is also bounded because the written content is constrained to export output, limiting straightforward code-execution unless the write lands on a sensitive path (e.g., a startup script or web-served file). Vendor did not respond and no fixed version is published, which slightly raises operational risk for exposed instances.

An attacker who can reach a dbgate (<=7.3.1) API instance sends a crafted export request to the exportModelSql endpoint with an outputFile value containing directory-traversal sequences (e.g., ../../). The server writes the SQL model export to an attacker-chosen filesystem location, enabling arbitrary file write, potential overwrite of existing files, or dropping content into a sensitive path. A public proof-of-concept for this arbitrary-write path traversal is available on GitHub.