CVE-2026-101066

Name of the Vulnerable Software and Affected Versions dbgate versions prior to 7.3.2

Description A path traversal issue exists in the Archive Link Creation component. A remote attacker can manipulate the linkedFolder argument within the createLink() function located in the packages/api/src/controllers/archive.js file to access files or directories outside the intended folder.

Recommendations Update dbgate to version 7.3.2 or later. As a temporary workaround, restrict access to the createLink() function until the update is applied.