CVE-2026-101068 Details

A critical path traversal vulnerability has been identified in DbGate versions through 7.3.1. The issue arises in the Create Connection Endpoint, specifically within the zipJsonLinesData function of the file packages/api/src/utility/zipJsonLinesData.js. The vulnerability allows remote exploitation by manipulating the filePath parameter, which is passed directly to a file write operation without proper validation. This oversight can be exploited by an unauthenticated attacker to overwrite existing files with ZIP-formatted content, leading to denial of service or corruption of system configuration.

Users are advised to update to DbGate version 7.3.2 or later, where this vulnerability has been addressed. For those unable to update, a manual code modification can be made by integrating the checkSecureExportFilePath validation into the zipJsonLinesData function, ensuring that file paths are properly sanitized before being used in file system operations.