CVE-2026-101070
Deferred Deferred - Pending Action

Path Traversal Vulnerability in dbgate Files Endpoint

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: VulDB

Description
A security vulnerability has been detected in dbgate up to 7.3.1. Affected by this vulnerability is the function files of the file packages/api/src/controllers/runners.js of the component Files Endpoint. The manipulation of the argument runid leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-101070
EUVD
EUVD-2026-88253

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dbgate dbgate to 7.3.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a path traversal vulnerability in DbGate versions up to 7.3.1. The issue occurs in the runners/files endpoint where the runid parameter is not properly validated. Attackers can manipulate this parameter to traverse directories by supplying sequences like ../../../../etc, allowing them to list directory contents on the server without authentication.

Detection Guidance

To detect this vulnerability, check if your DbGate instance is running a version up to 7.3.1. Send a crafted HTTP request to the /runners/files endpoint with a malicious runid parameter like ../../../../etc. If the server responds with directory contents, the system is vulnerable.

Impact Analysis

An attacker could exploit this to gather sensitive information such as file names, sizes, and absolute paths. They may confirm the presence of critical files like /etc/shadow or database files, enabling further attacks. The vulnerability requires no authentication in default deployments, making it easier to exploit.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection such as GDPR and HIPAA. Exposure of file structures and sensitive information may result in regulatory penalties and loss of trust.

Mitigation Strategies

Immediately upgrade DbGate to a version beyond 7.3.1 if available. If no patch exists, restrict access to the /runners/files endpoint via network controls or disable it entirely. Monitor for suspicious requests containing path traversal sequences.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101070. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart