EUVD-2026-86252
GHSA-8q9j-w2gh-55mq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged DbGate user
-
DeliveryCraft request to files-style endpoint with traversal in filePath/uri
-
Exploitfs.readFile resolves path outside intended directory
-
ExecutionRead sensitive server files
-
ImpactExfiltrate disclosed contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated low-privileged session (PR:L) on a network-reachable DbGate deployment (typically the self-hosted web/server mode where packages/api serves the files-style endpoint) running a version up to 7.2.5 or 7.3.1-premium-beta.1. No user interaction is needed. Limiting factors: the endpoint must be reachable and the attacker must hold valid credentials, so purely local desktop/Electron single-user installs without an exposed API are largely out of scope; exploitation value depends on what files the DbGate process user can read on the host. |
| Impact | This is a moderate-risk, authenticated information-disclosure issue, not a critical one. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network reach with low attack complexity but requires PR:L - a low-privileged authenticated session against a DbGate instance - so it is NOT an unauthenticated internet-spray bug. VulDB's 5.3 rating spreads impact across VC:L/VI:L/VA:L; I dispute that split, since an arbitrary-file-read path traversal (CWE-22) is a confidentiality problem with negligible integrity/availability effect, and depending on what the endpoint returns it can read sensitive files (config, credentials, keys) beyond the intended style directory, arguably warranting C:H rather than low. No EPSS score, no CISA KEV listing, and no public exploit code were provided; exploitation status is therefore 'no public exploit identified at time of analysis.' The E:X (Exploit Maturity: Not Defined) in the 4.0 vector reinforces that no maturity signal exists. The single-source VulDB origin, absence of a vendor advisory, and vendor non-response mean affected-version boundaries and patch status are unverified - treat the 'up to 7.2.5/7.3.1-premium-beta.1' range as claimed, not confirmed. |
| Exploit ScenarioDerived | An attacker with a low-privileged account on a network-reachable DbGate instance sends a crafted request to the files-style endpoint, supplying a filePath/uri argument containing directory-traversal sequences (e.g. ../../). The server's fs.readFile in packages/api/src/controllers/files.js resolves the manipulated path and returns the contents of files outside the intended directory, exposing configuration, credentials, or other sensitive data. No public POC or exploit code was provided in the intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Authenticated path traversal in DbGate's files-style API endpoint lets a low-privileged remote user read files outside the intended data directory by manipulating the filePath/uri argument passed to fs.readFile. The issue affects self-hosted web/server deployments running versions up to 7.2.5 and 7.3.1-premium-beta.1 where the packages/api controller is network-reachable; single-user desktop/Electron installs without an exposed API are largely out of scope. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but the vendor was contacted during disclosure and did not respond, so no official fix is confirmed. Overall this is a moderate-risk information-disclosure bug (assessed CVSS 3.1 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) whose real impact depends on which files the DbGate process can read.
RemediationAI
No vendor-released patch has been identified at time of analysis: DbGate did not respond to the disclosure, so there is no confirmed fixed version to upgrade to and any claim of an official fix would be unverified (track https://vuldb.com/vuln/409320 and the upstream DbGate repository for a security release covering packages/api/src/controllers/files.js). Until a fix lands, the highest-value action is to remove network reachability of the API: bind the DbGate server to 127.0.0.1 or a private management interface, and front it with a reverse proxy that enforces strong authentication and IP allow-listing - the trade-off is that this breaks legitimate remote/multi-user access and must be coordinated with users. Where the files-style browsing feature is not needed, disable or block the corresponding files controller routes at the proxy layer (deny requests to the files endpoint path) rather than patching code; the trade-off is loss of the file-browser UI functionality. Run the DbGate process as a dedicated unprivileged account inside a container with read-only mounts and no host filesystem bind mounts, and restrict its readable paths to only the intended data directory, accepting that this limits legitimate file access the product normally provides. Treat DbGate configuration files, environment variables, and any co-located credential material as potentially exposed and rotate secrets if compromise is suspected. Finally, monitor HTTP access logs for traversal sequences (../, encoded variants such as %2e%2e%2f, and absolute paths) in the filePath/uri parameter, since detection is feasible at the proxy even without an application fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal). DbGate is a cross-platform database client and web GUI implemented primarily in Node.js; its server-side API layer in packages/api/src/controllers/files.js exposes a files-style endpoint that reads content using Node's fs.readFile. Because the user-supplied filePath/uri value is used to resolve the target path without adequate canonicalization and root-directory confinement, an attacker can inject '../' sequences or an absolute/resolved path to escape the intended base directory and read arbitrary files readable by the DbGate process UID. The public CPE cpe:2.3:a:n/a:dbgate:*:*:*:*:*:*:*:* is unbounded (vendor field 'n/a'), so version scoping must come from the advisory text (<=7.2.5 and 7.3.1-premium-beta.1) rather than the CPE. The vendor's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X) indicates a network-reachable, non-interactive issue requiring low privileges with limited CIA impact, while the independent assessment re-scores the same surface under CVSS 3.1 as C:H with no integrity or availability impact, reflecting that read-only access to sensitive host files (configuration, credentials, database dumps) is the meaningful outcome. The E:X metric in the supplied 4.0 vector means exploit maturity was not defined at scoring time, which is consistent with the absence of any observed exploitation signal.
Know when Dbgate gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Authenticated network endpoint (PR:L, AV:N/AC:L); arbitrary file read via traversal is confidentiality-only, so C:H with I:N/A:N and unchanged scope.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
DescriptionCVE.org
A vulnerability has been found in DbGate up to 7.2.5/7.3.1-premium-beta.1. This impacts the function fs.readFile of the file packages/api/src/controllers/files.js of the component files-style Endpoint. The manipulation of the argument filePath/uri leads to path traversal. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Path traversal in DbGate 7.3.1 and earlier allows unauthenticated remote attackers to read arbitrary files from the serv
Path traversal in DbGate versions up to 6.8.1, 7.0.2, 7.1.8, 7.2.5, and 7.3.1 allows remote attackers to write files out
Path traversal in DbGate versions up to 7.3.1 allows unauthenticated remote attackers to write arbitrary files via the o
Path traversal in DbGate versions up to 7.3.1 allows unauthenticated remote attackers to write arbitrary files via the C
Unauthenticated remote path traversal in DbGate through 7.3.1 allows attackers to manipulate the linkedFolder argument i
Arbitrary file read and write in DbGate through version 7.2.6 allows authenticated low-privilege users to escape the app
Code injection in DbGate (a web-based database GUI) versions up to 7.2.5-beta.5 lets an authenticated user who can creat
Server-side request forgery in DbGate versions 7.1.0 through 7.1.4 allows authenticated remote attackers to manipulate t
Cross-site scripting in DbGate's SVG Icon String Handler allows a remote authenticated attacker to inject malicious scri
Exploit-DB