CVE-2026-101067: dbgate Path Traversal Vulnerability

CVE-2026-101067 Overview

CVE-2026-101067 is a path traversal vulnerability [CWE-22] in dbgate, an open-source database management tool. The flaw resides in the saveUploadedFile function within files.js, which handles the save-uploaded-file endpoint. Attackers can manipulate the filePath and fileName arguments to write files outside the intended upload directory. The vulnerability affects dbgate versions up to 6.8.1, 7.0.2, 7.1.8, 7.2.5, and 7.3.1. Remote exploitation is possible, and a public exploit has been disclosed. The vendor was contacted prior to publication but did not respond to the disclosure.

Critical Impact

Remote attackers can write arbitrary files to locations outside the intended upload directory by supplying crafted path traversal sequences in file upload requests, potentially leading to configuration tampering or code execution.

Affected Products

• dbgate versions up to and including 6.8.1
• dbgate versions up to and including 7.0.2, 7.1.8, 7.2.5
• dbgate versions up to and including 7.3.1

Discovery Timeline

• 2026-09-28 - CVE CVE-2026-101067 published to NVD
• 2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-101067

Vulnerability Analysis

The vulnerability resides in the saveUploadedFile function of files.js, which processes uploaded files on the save-uploaded-file endpoint. The function accepts filePath and fileName parameters from client-supplied input and uses them to construct the destination path on disk. Because the implementation does not normalize or validate these parameters, directory traversal sequences such as ../ are preserved during path construction. An attacker can therefore place files anywhere the dbgate process has write permission. Depending on the deployment, this can enable configuration tampering, overwriting of application source files, or placement of web shells in server-accessible directories.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The saveUploadedFile handler concatenates attacker-controlled values into the output path without canonicalizing the result or confirming that the resolved path remains inside the intended upload base directory.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted request to the save-uploaded-file endpoint containing traversal sequences in the filePath or fileName fields. The dbgate server writes the uploaded content to the resolved path. The public proof-of-concept documents the exact request structure needed to trigger the flaw. See the GitHub CVE Document for technical details on the request format and payload structure.

Detection Methods for CVE-2026-101067

Indicators of Compromise

• HTTP requests to the save-uploaded-file endpoint containing ../, ..\, or URL-encoded traversal sequences (%2e%2e%2f) in the filePath or fileName parameters.
• Files written by the dbgate process to directories outside the configured upload folder.
• Unexpected modifications to dbgate configuration files, application source files, or system directories.

Detection Strategies

• Inspect web proxy and application logs for POST requests to save-uploaded-file with suspicious path parameters.
• Deploy file integrity monitoring on the dbgate installation directory and any adjacent directories writable by the service account.
• Use web application firewall rules to flag or block traversal patterns in multipart upload parameters targeting dbgate endpoints.

Monitoring Recommendations

• Alert on new file creation outside the designated upload path by the dbgate process.
• Correlate upload endpoint activity with subsequent process execution or outbound connections originating from the dbgate host.
• Review authentication proxies or reverse proxies for unauthenticated requests reaching dbgate endpoints exposed to untrusted networks.

How to Mitigate CVE-2026-101067

Immediate Actions Required

• Restrict network access to dbgate instances so that the save-uploaded-file endpoint is not reachable from untrusted networks.
• Place dbgate behind an authenticating reverse proxy and block requests containing path traversal sequences at the proxy layer.
• Audit the dbgate upload directory and the broader filesystem for files created outside expected locations.

Patch Information

At the time of publication, no vendor-supplied patch has been referenced. The vendor was contacted prior to disclosure but did not respond. Monitor the dbgate project repository and the VulDB entry for CVE-2026-101067 for updated fix information.

Workarounds

• Run dbgate under a least-privilege service account that cannot write to sensitive directories such as application source paths or system configuration folders.
• Deploy WAF or reverse-proxy rules that reject requests to save-uploaded-file containing .., encoded traversal sequences, or absolute paths in upload parameters.
• If the upload feature is not required, disable or firewall off the save-uploaded-file endpoint until a patched release is available.

# Example nginx rule to block traversal patterns in dbgate upload requests
location /save-uploaded-file {
    if ($request_body ~* "(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)") {
        return 403;
    }
    proxy_pass http://dbgate_backend;
}