CVE-2026-85176 | BDVDB-2026-367802 Detail
dbgatedbgate
Description#
DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName() to bypass directory containment and access sensitive files including encrypted database credentials stored in connections configuration.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
- CWE-73 External Control of File Name or Path
References#
- https://github.com/dbgate/dbgate/issues/1502
- https://github.com/dbgate/dbgate
- https://github.com/dbgate/dbgate/blob/v7.2.6/packages/api/src/utility/getJslFileName.js
- https://github.com/dbgate/dbgate/blob/v7.2.6/packages/api/src/controllers/jsldata.js
- https://www.vulncheck.com/advisories/dbgate-through-7.2.6-arbitrary-file-read-and-write-via-file-jslid
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.