# CVE-2026-101068: DbGate path traversal in Create Connection Endpoint

Source: https://junglewise.ai/threats/cve-2026-101068-a-security-flaw-has-been-discovered-in-dbgate-up-to-7-3-1-this  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-28. Updated: 2026-09-28  
License: CC BY 4.0 with a link back

CVE-2026-101068 · Severity: medium · CVSS 6.5 · Published 2026-09-28

DbGate is a database management interface used to configure and manage database connections. A path traversal vulnerability in the config export endpoint allows unauthenticated attackers to write arbitrary ZIP files to any location on the system, potentially overwriting critical system files, corrupting configurations, or causing denial of service. This requires no authentication in default deployments.

Technologies: [DbGate](https://junglewise.ai/threats/technologies/dbgate). Vendors: [DbGate](https://junglewise.ai/threats/vendors/dbgate).

## Quick answers

**Is CVE-2026-101068 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-101068 being exploited in the wild.

**How severe is CVE-2026-101068?** Medium severity, with a CVSS score of 6.5, published 28 September 2026.

**Which products and versions are affected?** DbGate up to 7.3.1.

**Is there a fix for CVE-2026-101068?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-101068 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-101068?** Check whether you run DbGate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The zipJsonLinesData function in the Create Connection Endpoint fails to validate the filePath parameter before passing it to fs.createWriteStream(), allowing arbitrary filesystem writes. Unlike other export endpoints hardened with checkSecureExportFilePath validation, this endpoint accepts any absolute path not prefixed with 'archive:'. An unauthenticated remote attacker can send a POST request to /config/create-connections-and-settings-zip with a malicious filePath to write ZIP content to system-critical locations.

## Affected products

- DbGate DbGate up to 7.3.1

## Timeline

- 2026-09-28: disclosed: Public disclosure with proof of concept
- 2026-08-14: exploited: Exploit verified on version 7.2.5

## References

- [https://github.com/0xGenesi/CVE/blob/main/dbgate_config_zip_arbitrary_write.md](https://github.com/0xGenesi/CVE/blob/main/dbgate_config_zip_arbitrary_write.md)
- [https://vuldb.com/cve/CVE-2026-101068](https://vuldb.com/cve/CVE-2026-101068)

## Related threats

- [DbGate missing authorization in connection management](https://junglewise.ai/threats/cve-2026-121455-dbgate-before-7-3-3-contains-a-missing-authorization)
- [DbGate path traversal in Files Endpoint](https://junglewise.ai/threats/cve-2026-101070-a-security-vulnerability-has-been-detected-in-dbgate-up-to-7-3-1)
- [DbGate arbitrary file write via path traversal in exportModelSql](https://junglewise.ai/threats/cve-2026-101069-a-weakness-has-been-identified-in-dbgate-up-to-7-3-1-affected-is)
- [DbGate path traversal in save-uploaded-file endpoint](https://junglewise.ai/threats/cve-2026-101067-a-vulnerability-was-identified-in-dbgate-up-to-6-8-1-7-0-2-7-1-8)
- [DbGate path traversal in archive link creation](https://junglewise.ai/threats/cve-2026-101066-a-vulnerability-was-determined-in-dbgate-up-to-7-3-1-the)