CVE-2026-101066 Path Traversal in Dbgate

Dbgate versions up to 7.3.1 are vulnerable to a path traversal vulnerability identified as CVE-2026-101066. The issue exists within the createLink function located in packages/api/src/controllers/archive.js. An attacker can manipulate the linkedFolder argument to break out of the intended directory structure and access sensitive files on the host server. This vulnerability is remotely exploitable without authentication and is currently subject to public disclosure with no available vendor patch. Given the nature of Dbgate as a database management tool, successful exploitation could lead to the exposure of database configuration files, credentials, and other sensitive system information stored on the host running the application.

Impact

Successful exploitation allows remote attackers to read unauthorized files from the filesystem where Dbgate is installed. This can lead to full system compromise if configuration files containing database credentials are exfiltrated. The vulnerability affects all deployments of Dbgate versions 7.3.1 and earlier, regardless of the underlying operating system.

Recommendation

Prioritized actions for security teams:

• Identify all instances of Dbgate deployed within the environment and audit their exposure to the internet.
• Apply network-level access control lists (ACLs) to restrict access to Dbgate interfaces to trusted management subnets until a patch is released.
• Monitor web server access logs for requests containing directory traversal patterns such as "../" in the linkedFolder parameter targeting the archive controller.
• Implement file integrity monitoring (FIM) on critical application configuration files to detect unauthorized access attempts.