DbGate CVE-2026-101070

Requires network reachability to the DbGate API/web server and the runner Files Endpoint being accessible; the attacker manipulates the 'runid' argument with directory-traversal sequences. Per CVSS PR:N/UI:N, no authentication or user interaction is needed against a default-reachable instance. Practical exposure is limited by whether DbGate is deployed in server/web mode and exposed to the attacker's network rather than run purely as a local desktop client; the disclosure indicates no vendor fix is available.

This is a CWE-22 path traversal in DbGate's runner Files Endpoint (packages/api/src/controllers/runners.js) via the 'runid' argument. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:L only, E:P) describes remote, unauthenticated, low-complexity exploitation with limited confidentiality impact and no integrity/availability impact - consistent with reading files. POC availability is confirmed (publicly available exploit on GitHub, E:P in the vector), but this is NOT active exploitation: no KEV listing and no EPSS score are provided, so exploitation is publicly available exploit code exists, not confirmed in-the-wild use. The 6.9 (Medium) score is credible but the VC:L rating may understate risk: path traversal in a file-serving endpoint frequently permits arbitrary local file reads (source, config, credentials), which would justify high confidentiality - verify the actual read scope against the disclosure. Real-world priority is tempered by DbGate's niche footprint and the requirement that the API be network-reachable, but the unauthenticated + low-complexity + public-POC combination makes any internet-exposed instance a genuine, promptly-patchable concern. Vendor did not respond to disclosure, so no official fix is confirmed.

An attacker who can reach a DbGate API instance sends a crafted request to the runner Files Endpoint with a 'runid' value containing traversal sequences (e.g. ../../) to escape the intended runner directory and read arbitrary files on the host. No authentication or user interaction is required per the CVSS vector, and a public proof-of-concept exists on GitHub, lowering the bar to opportunistic exploitation.