Is CVE-2026-101068 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-101068 being exploited in the wild.

How severe is CVE-2026-101068?

Medium severity, with a CVSS score of 6.5, published 28 September 2026.

Is there a fix for CVE-2026-101068?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-101068 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-101068?

Check whether you run DbGate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101068: DbGate path traversal in Create Connection Endpoint

CVE-2026-101068 · Severity: medium · CVSS 6.5 · Published 2026-09-28

DbGate is a database management interface used to configure and manage database connections. A path traversal vulnerability in the config export endpoint allows unauthenticated attackers to write arbitrary ZIP files to any location on the system, potentially overwriting critical system files, corrupting configurations, or causing denial of service. This requires no authentication in default deployments.

Technologies: DbGate. Vendors: DbGate.

Quick answers

Is CVE-2026-101068 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-101068 being exploited in the wild.
How severe is CVE-2026-101068?: Medium severity, with a CVSS score of 6.5, published 28 September 2026.
Which products and versions are affected?: DbGate up to 7.3.1.
Is there a fix for CVE-2026-101068?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-101068 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-101068?: Check whether you run DbGate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The zipJsonLinesData function in the Create Connection Endpoint fails to validate the filePath parameter before passing it to fs.createWriteStream(), allowing arbitrary filesystem writes. Unlike other export endpoints hardened with checkSecureExportFilePath validation, this endpoint accepts any absolute path not prefixed with 'archive:'. An unauthenticated remote attacker can send a POST request to /config/create-connections-and-settings-zip with a malicious filePath to write ZIP content to system-critical locations.

Affected products

DbGate DbGate up to 7.3.1

Timeline

2026-09-28: disclosed: Public disclosure with proof of concept
2026-08-14: exploited: Exploit verified on version 7.2.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.