CVE-2026-85176
DbGate through 7.2.6 Arbitrary File Read and Write via file:// jslid
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName() to bypass directory containment and access sensitive files including encrypted database credentials stored in connections configuration.
| CWE | CWE-73 |
| Vendor | dbgate |
| Product | dbgate |
| Published | Sep 3, 2026 |
| Last Updated | Sep 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for dbgate dbgate
Be the first to know when new high vulnerabilities affecting dbgate dbgate are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
dbgate / dbgate
0 ≤ 7.2.6
References
github.com: https://github.com/dbgate/dbgate/issues/1502 github.com: https://github.com/dbgate/dbgate github.com: https://github.com/dbgate/dbgate/blob/v7.2.6/packages/api/src/utility/getJslFileName.js github.com: https://github.com/dbgate/dbgate/blob/v7.2.6/packages/api/src/controllers/jsldata.js vulncheck.com: https://www.vulncheck.com/advisories/dbgate-through-7.2.6-arbitrary-file-read-and-write-via-file-jslid
Credits
🔍 George Chen