CVE-2026-101067

Name of the Vulnerable Software and Affected Versions dbgate versions 6.x through 6.8.1 dbgate versions 7.0.x through 7.0.2 dbgate versions 7.1.x through 7.1.8 dbgate versions 7.2.x through 7.2.5 dbgate versions 7.3.x through 7.3.1

Description A path traversal issue exists in the save-uploaded-file endpoint within the files.js file. This occurs when the saveUploadedFile() function improperly handles the filePath and fileName arguments, allowing a remote attacker to manipulate these variables to access or overwrite files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder.

Recommendations As a temporary workaround, restrict access to the save-uploaded-file endpoint or avoid using the filePath and fileName arguments until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.