Is CVE-2026-101066 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-101066 being exploited in the wild.

How severe is CVE-2026-101066?

High severity, with a CVSS score of 7.3, published 28 September 2026.

Is there a fix for CVE-2026-101066?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-101066 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-101066?

Check whether you run DbGate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101066: DbGate path traversal in archive link creation

CVE-2026-101066 · Severity: high · CVSS 7.3 · Published 2026-09-28

DbGate is a database management tool that allows users to create archive links pointing to directories. A path traversal vulnerability in the archive link creation function allows attackers to read, write, or delete arbitrary files on the server. In the default configuration where authentication is disabled, an unauthenticated attacker can exploit this remotely to execute commands or access sensitive data.

Technologies: DbGate. Vendors: DbGate.

Quick answers

Is CVE-2026-101066 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-101066 being exploited in the wild.
How severe is CVE-2026-101066?: High severity, with a CVSS score of 7.3, published 28 September 2026.
Which products and versions are affected?: DbGate up to 7.3.1.
Is there a fix for CVE-2026-101066?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-101066 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-101066?: Check whether you run DbGate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The createLink function in packages/api/src/controllers/archive.js validates only the basename of the linkedFolder parameter using assertSafeArchiveName(), allowing attackers to inject directory traversal sequences in the full path that gets written to .link files. The resolveArchiveFolder() function then uses this attacker-controlled path for subsequent archive operations (files/load, files/save, archive/saveText), enabling arbitrary file read/write/delete. The vulnerability is unauthenticated remote when deployed with default anonymous authentication enabled.

Affected products

DbGate DbGate up to 7.3.1

Timeline

2026-09-28: disclosed
other: Vendor contacted early but did not respond

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.