CVE-2026-101070: dbgate Path Traversal Vulnerability

CVE-2026-101070 Overview

CVE-2026-101070 is a path traversal vulnerability [CWE-22] in DBGate versions up to 7.3.1. The flaw resides in the files function within packages/api/src/controllers/runners.js, part of the Files Endpoint component. Attackers can manipulate the runid argument to escape the intended directory and access files outside the designated runner workspace. The attack can be executed remotely over the network without authentication or user interaction. Public disclosure of the exploit technique has already occurred. According to the disclosure, the vendor was contacted prior to publication but did not respond.

Critical Impact
Unauthenticated remote attackers can read arbitrary files accessible to the DBGate API process by injecting traversal sequences into the runid parameter of the Files Endpoint.

Affected Products

DBGate versions up to and including 7.3.1
Component: Files Endpoint (packages/api/src/controllers/runners.js)
Function: files

Discovery Timeline

2026-09-28 - CVE-2026-101070 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-101070

Vulnerability Analysis

The vulnerability affects the files function inside packages/api/src/controllers/runners.js in DBGate. This controller is responsible for returning files associated with a given runner execution identified by runid. The function does not sanitize the runid input before using it in a file system path operation. An attacker can supply traversal sequences such as ../ within runid to escape the runner workspace directory and read files anywhere the DBGate server process has filesystem access.

DBGate is a browser-based database manager typically deployed as a self-hosted web application. Exposing an unauthenticated path traversal endpoint on such a service puts configuration files, credentials, SSH keys, and database connection strings at direct risk of exposure.

Root Cause

The root cause is missing input validation and path normalization on the runid argument before it is concatenated into a filesystem path. The absence of allow-list checks or path.resolve boundary enforcement allows attacker-controlled segments to traverse the directory hierarchy.

Attack Vector

The attack vector is network-based. An attacker sends an HTTP request to the vulnerable Files Endpoint with a crafted runid value containing directory traversal sequences. No authentication, privileges, or user interaction are required. The vulnerability discloses file contents but does not directly provide code execution or write access.

Technical details and a proof-of-concept are documented in the GitHub CVE PoC Documentation and VulDB CVE-2026-101070 Details.

Detection Methods for CVE-2026-101070

Indicators of Compromise

HTTP requests to runner files endpoints containing ../, ..%2f, ..\, or encoded traversal variants in the runid parameter.
Access attempts targeting sensitive paths such as /etc/passwd, .env, id_rsa, or DBGate configuration files via the runners API.
Unusual DBGate API responses returning file contents inconsistent with runner output formats.

Detection Strategies

Inspect web server and reverse proxy logs for requests to the runners API containing path traversal patterns in query string or path parameters.
Enable application-layer logging within DBGate to capture runid values submitted to the Files Endpoint.
Deploy a web application firewall rule to flag traversal payloads targeting the /runners/ route.

Monitoring Recommendations

Alert on bursts of HTTP 200 responses from the DBGate Files Endpoint originating from a single source address.
Monitor process-level file access by the DBGate Node.js process for reads outside the expected runner workspace directory.
Correlate DBGate API activity with outbound data transfer volumes to identify potential file exfiltration.

How to Mitigate CVE-2026-101070

Immediate Actions Required

Remove DBGate instances from direct internet exposure and place them behind authenticated reverse proxies or VPN gateways.
Restrict network access to the DBGate API to trusted administrator source addresses using firewall rules.
Rotate credentials, API tokens, and private keys that may have been accessible to the DBGate server process.
Review DBGate server logs for historical requests containing traversal patterns in runid.

Patch Information

At the time of publication, no vendor patch has been referenced. The disclosure notes that the vendor was contacted but did not respond. Monitor the DBGate project repository for updates beyond version 7.3.1 that address the files function in packages/api/src/controllers/runners.js.

Workarounds

Block requests containing .., %2e%2e, or backslash sequences in the runid parameter at a reverse proxy or WAF.
Run DBGate under a dedicated low-privilege operating system account with filesystem access restricted to only the directories required for operation.
Deploy DBGate inside a container with a read-only root filesystem and minimal mounted volumes to limit the scope of readable files.
Disable or firewall off the runners API if runner functionality is not required in the deployment.

bash

# Example nginx reverse proxy rule to block traversal payloads targeting the runners endpoint
location /runners/ {
    if ($request_uri ~* "(\.\./|\.\.%2f|%2e%2e/|\.\.\\)") {
        return 403;
    }
    proxy_pass http://127.0.0.1:3000;
}