# CVE-2026-85176: DbGate jsldata controller arbitrary file access

Source: https://junglewise.ai/threats/cve-2026-85176-dbgate-jsldata-controller-arbitrary-file-access  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-85176 · Severity: high · CVSS 8.8 · Published 2026-09-03

DbGate is a database management tool that supports MySQL, PostgreSQL, SQL Server, MongoDB, and other databases. A validation flaw in the jsldata controller allows authenticated users to read and write arbitrary files on the system, including access to encrypted database credentials stored in application configuration.

Technologies: [DbGate](https://junglewise.ai/threats/technologies/dbgate). Vendors: [DbGate](https://junglewise.ai/threats/vendors/dbgate).

## Quick answers

**Is CVE-2026-85176 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85176 being exploited in the wild.

**How severe is CVE-2026-85176?** High severity, with a CVSS score of 8.8, published 3 September 2026.

**Which products and versions are affected?** DbGate prior to patch for CVE-2026-85176.

**Is there a fix for CVE-2026-85176?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-85176 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-85176?** Check whether you run DbGate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a path traversal / arbitrary file access flaw in the jsldata controller due to insufficient validation of the jslid parameter. The vulnerable getJslFileName() function fails to properly validate or sanitize user-supplied input, allowing directory containment bypass. An authenticated attacker can exploit this by crafting requests using the file:// scheme to access files outside the intended directory structure. This enables reading arbitrary files (including encrypted database connection credentials) and writing arbitrary files to the system. Patches should implement strict input validation and path normalization.

## Affected products

- DbGate DbGate prior to patch for CVE-2026-85176

## Timeline

- 2026-09-03: disclosed

## References

- [https://github.com/dbgate/dbgate](https://github.com/dbgate/dbgate)
- [https://github.com/dbgate/dbgate/blob/v7.2.6/packages/api/src/controllers/jsldata.js](https://github.com/dbgate/dbgate/blob/v7.2.6/packages/api/src/controllers/jsldata.js)

## Related threats

- [DbGate missing authorization in connection management](https://junglewise.ai/threats/cve-2026-121455-dbgate-before-7-3-3-contains-a-missing-authorization)
- [DbGate path traversal in Files Endpoint](https://junglewise.ai/threats/cve-2026-101070-a-security-vulnerability-has-been-detected-in-dbgate-up-to-7-3-1)
- [DbGate arbitrary file write via path traversal in exportModelSql](https://junglewise.ai/threats/cve-2026-101069-a-weakness-has-been-identified-in-dbgate-up-to-7-3-1-affected-is)
- [DbGate path traversal in Create Connection Endpoint](https://junglewise.ai/threats/cve-2026-101068-a-security-flaw-has-been-discovered-in-dbgate-up-to-7-3-1-this)
- [DbGate path traversal in save-uploaded-file endpoint](https://junglewise.ai/threats/cve-2026-101067-a-vulnerability-was-identified-in-dbgate-up-to-6-8-1-7-0-2-7-1-8)