CVE-2026-101066: dbgate Path Traversal Vulnerability

CVE-2026-101066 Overview

CVE-2026-101066 is a path traversal vulnerability [CWE-22] affecting dbgate versions up to 7.3.1. The flaw resides in the createLink function within packages/api/src/controllers/archive.js, part of the Archive Link Creation component. Attackers can manipulate the linkedFolder argument to traverse outside the intended directory. The attack is remotely initiated and requires no authentication or user interaction. A public proof-of-concept exploit has been disclosed, and the vendor did not respond to disclosure attempts.

Critical Impact
Unauthenticated remote attackers can abuse the linkedFolder parameter to create archive links pointing to arbitrary filesystem locations, potentially exposing or linking sensitive files outside the application's intended scope.

Affected Products

dbgate versions up to and including 7.3.1
Component: Archive Link Creation (packages/api/src/controllers/archive.js)
Function: createLink

Discovery Timeline

2026-09-28 - CVE CVE-2026-101066 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-101066

Vulnerability Analysis

The vulnerability lives in the createLink function of packages/api/src/controllers/archive.js. This function accepts a user-supplied linkedFolder argument and uses it to construct filesystem paths for archive link creation. The implementation does not sanitize or canonicalize the input against directory traversal sequences such as ../.

An unauthenticated remote attacker can submit a crafted linkedFolder value containing traversal sequences. The server then resolves the path outside the archive directory boundary. This grants the attacker the ability to reference arbitrary filesystem locations through dbgate's archive link mechanism.

Root Cause

The root cause is missing input validation on the linkedFolder parameter inside createLink. The code trusts caller-supplied path segments without enforcing a safe base directory. Classified as CWE-22 Improper Limitation of a Pathname to a Restricted Directory, the flaw lets .. sequences escape the intended archive root.

Attack Vector

Exploitation requires only network access to the dbgate API endpoint handling archive link creation. No authentication, privileges, or user interaction are required. The attacker sends a request to the archive controller with a linkedFolder value referencing a path outside the archive directory. See the GitHub PoC Repository for exploitation details.

Detection Methods for CVE-2026-101066

Indicators of Compromise

Requests to the dbgate archive API containing ../ or URL-encoded traversal sequences (%2e%2e%2f) in the linkedFolder parameter.
Unexpected symbolic links or archive link entries referencing paths outside the configured archive directory.
Access patterns from unauthenticated remote clients targeting the createLink endpoint.

Detection Strategies

Inspect HTTP request bodies and query strings sent to the dbgate archive controller for path traversal payloads.
Audit the archive directory structure for links resolving to system directories such as /etc, /root, or application configuration locations.
Correlate anomalous API activity on archive.js endpoints with filesystem link creation events on the host.

Monitoring Recommendations

Enable verbose request logging on the dbgate API to capture linkedFolder parameter values for forensic review.
Monitor the dbgate process for filesystem operations outside its working directory using OS-level auditing such as auditd or Sysmon.
Alert on any outbound file read operations initiated by the dbgate service that touch sensitive directories.

How to Mitigate CVE-2026-101066

Immediate Actions Required

Restrict network access to dbgate instances so only trusted operators can reach the API, ideally placing the service behind VPN or authenticated reverse proxy.
Review existing archive link entries for traversal-based paths and remove any suspicious links.
Monitor the dbgate project repository for an official patched release above 7.3.1.

Patch Information

At the time of publication, no vendor-supplied patch has been confirmed. The vendor was contacted prior to disclosure but did not respond. Track the VulDB CVE Entry and the dbgate project release notes for remediation updates.

Workarounds

Place dbgate behind a reverse proxy that filters requests containing .., %2e%2e, or encoded traversal patterns in the linkedFolder parameter.
Run the dbgate process as an unprivileged user with filesystem access restricted to its working directory using mandatory access controls such as AppArmor or SELinux.
Deploy dbgate inside a container with read-only mounts for sensitive host directories to limit the blast radius of path traversal.

bash

# Example reverse proxy filter (nginx) to block traversal payloads
location /api/archive/ {
    if ($args ~* "(\.\./|%2e%2e)") { return 403; }
    if ($request_body ~* "(\.\./|%2e%2e)") { return 403; }
    proxy_pass http://dbgate_backend;
}