Dbgate
Monthly
Arbitrary file read and write in DbGate through version 7.2.6 allows authenticated low-privilege users to escape the application's data directory by supplying file:// scheme URIs in the jslid parameter of the jsldata controller. The root function getJslFileName() performs no directory containment validation, exposing the full server filesystem to the DbGate process's OS-level permissions. The most critical consequence is exfiltration of encrypted database credentials from the connections configuration, enabling lateral movement to every database managed through the tool; the write primitive adds configuration tampering and potential code-plant risk.
DbGate before 7.3.3 does not enforce LOGIN_PERMISSIONS connection restrictions on the /connections/test and /connections/save endpoints, so an authenticated user who is supposed to be limited to specific database connections can instead submit arbitrary connection definitions. That lets the user probe internal database hosts through the test endpoint and overwrite stored connection definitions through the save endpoint, both with limited (Low) confidentiality and integrity impact. Exploitation requires a valid low-privilege account in a multi-user deployment that actually enforces per-connection restrictions; no public exploit code has been identified at time of analysis, and the issue is rated medium severity (CVSS 5.3) with a moderate rather than urgent priority.
Path traversal in DbGate 7.3.1 and earlier allows unauthenticated remote attackers to read arbitrary files from the server via the 'runid' parameter in the Files Endpoint of packages/api/src/controllers/runners.js. Publicly available exploit code exists, and no vendor-released patch has been identified at time of analysis. Exposure is limited to deployments where the DbGate API/web server is reachable by the attacker, rather than local desktop-only usage.
Path traversal in DbGate versions up to 7.3.1 allows unauthenticated remote attackers to write arbitrary files via the outputFile parameter in the exportModelSql function of the Export Handler. Publicly available exploit code exists, and the vendor did not respond to disclosure, so no official patch is available. The CVSS 4.0 score is 5.5 (medium), with limited integrity and availability impact; exploitation requires the DbGate API to be network-reachable, and full code execution depends on targeting a sensitive write path.
Path traversal in DbGate versions up to 7.3.1 allows unauthenticated remote attackers to write arbitrary files via the Create Connection endpoint's zipJsonLinesData function when the filePath argument is manipulated. Publicly available exploit code exists, and the endpoint was omitted from earlier hardening (PR #1530/commit 5f99b4d82) that added checkSecureExportFilePath to other export endpoints. Practical exploitation depends on the DbGate instance being network-reachable, as it is commonly bound to localhost.
Path traversal in DbGate versions up to 6.8.1, 7.0.2, 7.1.8, 7.2.5, and 7.3.1 allows remote attackers to write files outside the intended upload directory by manipulating the filePath or fileName argument in the saveUploadedFile function of the save-uploaded-file endpoint (files.js). Publicly available exploit code exists (per VulDB and a GitHub PoC), and the vendor was contacted but did not respond. The vendor's CVSS 4.0 vector rates all impacts as Low (base 5.5, AV:N/AC:L/AT:N/PR:N/UI:N), while an independent assessment rates integrity impact as High (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N); per the vendor vector no authentication is required, but this is unverified and many deployments may sit behind authentication, which would raise the effective privilege requirement.
Unauthenticated remote path traversal in DbGate through 7.3.1 allows attackers to manipulate the linkedFolder argument in the Archive Link Creation createLink endpoint and access paths outside the intended archive link location. Publicly available exploit code exists, and the vendor was contacted but did not respond; exploitation is limited mainly by whether the DbGate web/API service is reachable by the attacker and by the filesystem privileges of the DbGate process. The assessed impact is low against confidentiality, integrity, and availability (CVSS 3.1 C:L/I:L/A:N; CVSS 4.0 6.9 Medium).
Authenticated path traversal in DbGate's files-style API endpoint lets a low-privileged remote user read files outside the intended data directory by manipulating the filePath/uri argument passed to fs.readFile. The issue affects self-hosted web/server deployments running versions up to 7.2.5 and 7.3.1-premium-beta.1 where the packages/api controller is network-reachable; single-user desktop/Electron installs without an exposed API are largely out of scope. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but the vendor was contacted during disclosure and did not respond, so no official fix is confirmed. Overall this is a moderate-risk information-disclosure bug (assessed CVSS 3.1 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) whose real impact depends on which files the DbGate process can read.
Code injection in DbGate (a web-based database GUI) versions up to 7.2.5-beta.5 lets an authenticated user who can create or edit a JSON Runner or scheduled script inject text into the comment.text or script.schedule fields that escapes the generator's `//` comment wrapper and reconstitutes a `// @require <module>` or `// @schedule` directive, causing the server to load and execute attacker-supplied code. The flaw is remote, requires low privileges (PR:L) and no user interaction, and is limited to unpatched releases; it is fixed by upgrading to 7.2.5-beta.6 (upstream commit 70e7b6b58e464d7a015ba16e8d7574b420ee4877, PR #1527). There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though the EPSS-style exposure is mitigated mainly by the requirement for an authenticated account with runner-editing rights. This issue is explicitly distinct from CVE-2026-47668.
Cross-site scripting in DbGate's SVG Icon String Handler allows a remote authenticated attacker to inject malicious script via the applicationIcon argument in FontIcon.svelte, executing arbitrary JavaScript in a victim user's browser session. Affected versions span 7.1.0 through 7.1.4, with a confirmed fix released in v7.1.5. A public proof-of-concept exploit has been disclosed via VulDB, though EPSS at 0.03% (9th percentile) and SSVC's 'exploitation: none' designation indicate no observed active exploitation at time of analysis.
Server-side request forgery in DbGate versions 7.1.0 through 7.1.4 allows authenticated remote attackers to manipulate the `apiServerUrl1` function within the REST/GraphQL component to induce the DbGate server to make arbitrary outbound HTTP requests. A public proof-of-concept exploit is available, though EPSS of 0.03% (9th percentile) and SSVC exploitation status of 'none' indicate minimal observed real-world exploitation to date. The vendor did not respond to coordinated disclosure, leaving no vendor-released patch available at time of analysis.
Arbitrary file read and write in DbGate through version 7.2.6 allows authenticated low-privilege users to escape the application's data directory by supplying file:// scheme URIs in the jslid parameter of the jsldata controller. The root function getJslFileName() performs no directory containment validation, exposing the full server filesystem to the DbGate process's OS-level permissions. The most critical consequence is exfiltration of encrypted database credentials from the connections configuration, enabling lateral movement to every database managed through the tool; the write primitive adds configuration tampering and potential code-plant risk.
DbGate before 7.3.3 does not enforce LOGIN_PERMISSIONS connection restrictions on the /connections/test and /connections/save endpoints, so an authenticated user who is supposed to be limited to specific database connections can instead submit arbitrary connection definitions. That lets the user probe internal database hosts through the test endpoint and overwrite stored connection definitions through the save endpoint, both with limited (Low) confidentiality and integrity impact. Exploitation requires a valid low-privilege account in a multi-user deployment that actually enforces per-connection restrictions; no public exploit code has been identified at time of analysis, and the issue is rated medium severity (CVSS 5.3) with a moderate rather than urgent priority.
Path traversal in DbGate 7.3.1 and earlier allows unauthenticated remote attackers to read arbitrary files from the server via the 'runid' parameter in the Files Endpoint of packages/api/src/controllers/runners.js. Publicly available exploit code exists, and no vendor-released patch has been identified at time of analysis. Exposure is limited to deployments where the DbGate API/web server is reachable by the attacker, rather than local desktop-only usage.
Path traversal in DbGate versions up to 7.3.1 allows unauthenticated remote attackers to write arbitrary files via the outputFile parameter in the exportModelSql function of the Export Handler. Publicly available exploit code exists, and the vendor did not respond to disclosure, so no official patch is available. The CVSS 4.0 score is 5.5 (medium), with limited integrity and availability impact; exploitation requires the DbGate API to be network-reachable, and full code execution depends on targeting a sensitive write path.
Path traversal in DbGate versions up to 7.3.1 allows unauthenticated remote attackers to write arbitrary files via the Create Connection endpoint's zipJsonLinesData function when the filePath argument is manipulated. Publicly available exploit code exists, and the endpoint was omitted from earlier hardening (PR #1530/commit 5f99b4d82) that added checkSecureExportFilePath to other export endpoints. Practical exploitation depends on the DbGate instance being network-reachable, as it is commonly bound to localhost.
Path traversal in DbGate versions up to 6.8.1, 7.0.2, 7.1.8, 7.2.5, and 7.3.1 allows remote attackers to write files outside the intended upload directory by manipulating the filePath or fileName argument in the saveUploadedFile function of the save-uploaded-file endpoint (files.js). Publicly available exploit code exists (per VulDB and a GitHub PoC), and the vendor was contacted but did not respond. The vendor's CVSS 4.0 vector rates all impacts as Low (base 5.5, AV:N/AC:L/AT:N/PR:N/UI:N), while an independent assessment rates integrity impact as High (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N); per the vendor vector no authentication is required, but this is unverified and many deployments may sit behind authentication, which would raise the effective privilege requirement.
Unauthenticated remote path traversal in DbGate through 7.3.1 allows attackers to manipulate the linkedFolder argument in the Archive Link Creation createLink endpoint and access paths outside the intended archive link location. Publicly available exploit code exists, and the vendor was contacted but did not respond; exploitation is limited mainly by whether the DbGate web/API service is reachable by the attacker and by the filesystem privileges of the DbGate process. The assessed impact is low against confidentiality, integrity, and availability (CVSS 3.1 C:L/I:L/A:N; CVSS 4.0 6.9 Medium).
Authenticated path traversal in DbGate's files-style API endpoint lets a low-privileged remote user read files outside the intended data directory by manipulating the filePath/uri argument passed to fs.readFile. The issue affects self-hosted web/server deployments running versions up to 7.2.5 and 7.3.1-premium-beta.1 where the packages/api controller is network-reachable; single-user desktop/Electron installs without an exposed API are largely out of scope. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but the vendor was contacted during disclosure and did not respond, so no official fix is confirmed. Overall this is a moderate-risk information-disclosure bug (assessed CVSS 3.1 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) whose real impact depends on which files the DbGate process can read.
Code injection in DbGate (a web-based database GUI) versions up to 7.2.5-beta.5 lets an authenticated user who can create or edit a JSON Runner or scheduled script inject text into the comment.text or script.schedule fields that escapes the generator's `//` comment wrapper and reconstitutes a `// @require <module>` or `// @schedule` directive, causing the server to load and execute attacker-supplied code. The flaw is remote, requires low privileges (PR:L) and no user interaction, and is limited to unpatched releases; it is fixed by upgrading to 7.2.5-beta.6 (upstream commit 70e7b6b58e464d7a015ba16e8d7574b420ee4877, PR #1527). There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though the EPSS-style exposure is mitigated mainly by the requirement for an authenticated account with runner-editing rights. This issue is explicitly distinct from CVE-2026-47668.
Cross-site scripting in DbGate's SVG Icon String Handler allows a remote authenticated attacker to inject malicious script via the applicationIcon argument in FontIcon.svelte, executing arbitrary JavaScript in a victim user's browser session. Affected versions span 7.1.0 through 7.1.4, with a confirmed fix released in v7.1.5. A public proof-of-concept exploit has been disclosed via VulDB, though EPSS at 0.03% (9th percentile) and SSVC's 'exploitation: none' designation indicate no observed active exploitation at time of analysis.
Server-side request forgery in DbGate versions 7.1.0 through 7.1.4 allows authenticated remote attackers to manipulate the `apiServerUrl1` function within the REST/GraphQL component to induce the DbGate server to make arbitrary outbound HTTP requests. A public proof-of-concept exploit is available, though EPSS of 0.03% (9th percentile) and SSVC exploitation status of 'none' indicate minimal observed real-world exploitation to date. The vendor did not respond to coordinated disclosure, leaving no vendor-released patch available at time of analysis.