CVE-2026-101068: dbgate Create Connection Endpoint zipJsonLinesData.js zipJsonLinesData path traversal
A security flaw has been discovered in dbgate up to 7.3.1. This impacts the function zipJsonLinesData of the file packages/api/src/utility/zipJsonLinesData.js of the component Create Connection Endpoint. Performing a manipulation of the argument filePath results in path traversal. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. PR #1530 / commit 5f99b4d82 (7.2.5) hardened other export endpoints with checkSecureExportFilePath but omitted this endpoint. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
DbGate deployments up to version 7.3.1 are affected where the Create Connection Endpoint is reachable remotely. The vulnerable code is the zipJsonLinesData function in packages/api/src/utility/zipJsonLinesData.js.
What does an attacker need to exploit this issue?
Remote exploitation is possible with no privileges or user interaction indicated by the supplied severity vector. An attacker manipulates the filePath argument to trigger path traversal.
Is there public exploit information?
Yes. The exploit has been publicly released and may be used in attacks.
What can be done if an update is not immediately available?
Restrict remote access to the Create Connection Endpoint where possible. The supplied information identifies missing checkSecureExportFilePath hardening on this endpoint, although it does not provide a confirmed fixed version.
How does this differ from prior export-endpoint hardening?
PR #1530 / commit 5f99b4d82 in version 7.2.5 hardened other export endpoints with checkSecureExportFilePath. The Create Connection Endpoint was omitted from that hardening.