CVE-2026-85176: DbGate through 7.2.6 Arbitrary File Read and Write via file:// jslid
DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName() to bypass directory containment and access sensitive files including encrypted database credentials stored in connections configuration.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated DbGate user can exploit it. The provided vector indicates network reachability, low attack complexity, no user interaction, and low privileges required.
What access does an attacker gain?
An attacker can read and write arbitrary files by supplying file:// values through the jslid parameter handled by the jsldata controller. This can expose sensitive files, including encrypted database credentials in the connections configuration, and can also allow modification of files accessible to the DbGate process.
Which deployments are affected?
DbGate versions through 7.2.6 are identified as affected. The issue is in handling of jslid parameters, so deployments exposing the jsldata controller to authenticated users are relevant.