CVE-2026-101069

Name of the Vulnerable Software and Affected Versions dbgate versions prior to 7.3.2

Description A path traversal issue exists in the Export Handler component within the exportModelSql() function of the packages/api/src/controllers/databaseConnections.js file. A remote attacker can manipulate the outputFile argument to perform path traversal, which allows accessing or writing to files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder.

Recommendations Update dbgate to a version newer than 7.3.1. As a temporary mitigation, restrict access to the exportModelSql() function until a patch is applied.