Arbitrary File Access in DbGate via jsldata Controller

CVE-2026-85176 is a critical vulnerability affecting DbGate, specifically within the jsldata controller. The application fails to properly validate the jslid parameters, which are processed by the getJslFileName() function. An authenticated user can leverage the file:// scheme to bypass directory containment mechanisms. This flaw allows an attacker to access arbitrary files on the underlying host filesystem, including sensitive configuration files that store encrypted database credentials. Successful exploitation results in full file-read and file-write capabilities, potentially leading to total system compromise or further lateral movement by extracting stored credentials.

Impact

The vulnerability poses a severe risk to organizations using DbGate, as it allows authenticated attackers to read sensitive local files and overwrite critical application or system data. This can lead to the exfiltration of sensitive connection strings and encrypted credentials. The impact is significant for environments where DbGate is used to manage multiple database connections, as it provides a pathway for an attacker to gain credentials for all managed databases.

Recommendation

1. Identify all instances of DbGate within the infrastructure.
2. Monitor web application access logs for requests targeting the /jsldata controller with file:// URI schemes in the jslid parameter.
3. Apply patches provided by the vendor to address the improper validation in getJslFileName().
4. Implement strict network segmentation to restrict access to the DbGate web interface to trusted administrative IP ranges.