CVE-2026-101066: dbgate Archive Link Creation archive.js createLink path traversal
A vulnerability was determined in dbgate up to 7.3.1. The impacted element is the function createLink of the file packages/api/src/controllers/archive.js of the component Archive Link Creation. This manipulation of the argument linkedFolder causes path traversal. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require authentication or user interaction?
No. The CVSS vector indicates no privileges are required and no user interaction is needed; the attack complexity is rated low.
Which deployments are exposed?
DbGate versions up to and including 7.3.1 are identified as affected. Remote exploitation is possible, so deployments with the affected functionality reachable by an attacker are the relevant exposure scenario.
Is public exploit activity a concern?
Yes. The exploit has been publicly disclosed and may be used, increasing the likelihood of exploitation attempts.
Is a fixed version or temporary workaround identified?
The provided data does not identify a fixed release or a workaround. It also states that the vendor did not respond to the disclosure.