CVE-2026-97226: DbGate files-style Endpoint files.js fs.readFile path traversal
A vulnerability has been found in DbGate up to 7.2.5/7.3.1-premium-beta.1. This impacts the function fs.readFile of the file packages/api/src/controllers/files.js of the component files-style Endpoint. The manipulation of the argument filePath/uri leads to path traversal. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attack can be initiated remotely over the network, but the severity vector indicates that an attacker requires low-level privileges. No user interaction is required.
Which deployments should be treated as potentially affected?
DbGate versions up to 7.2.5 and 7.3.1-premium-beta.1 are identified as affected. The available information does not state whether the vulnerable endpoint is enabled in a default configuration.
What is the potential impact of successful exploitation?
The vulnerability is a path traversal in file reading functionality. The supplied severity vector indicates potential low impact to confidentiality, integrity, and availability.