Executive brief
DbGate is a database management tool that supports MySQL, PostgreSQL, SQL Server, MongoDB, and other databases. A validation flaw in the jsldata controller allows authenticated users to read and write arbitrary files on the system, including access to encrypted database credentials stored in application configuration.
Technical details
The vulnerability is a path traversal / arbitrary file access flaw in the jsldata controller due to insufficient validation of the jslid parameter. The vulnerable getJslFileName() function fails to properly validate or sanitize user-supplied input, allowing directory containment bypass. An authenticated attacker can exploit this by crafting requests using the file:// scheme to access files outside the intended directory structure. This enables reading arbitrary files (including encrypted database connection credentials) and writing arbitrary files to the system. Patches should implement strict input validation and path normalization.
Affected products
- DbGate DbGate prior to patch for CVE-2026-85176
Timeline
- 2026-09-03: disclosed