CVE-2026-85176

DbGate contains a path traversal flaw (CWE-73) in its jsldata controller, where the jslid parameter is not validated and is passed through getJslFileName(), allowing file:// scheme resolution that escapes the intended directory containment. An authenticated user can send a crafted jslid value to read or write arbitrary files on the host running DbGate. Because the web-facing controller is reachable over the network, a logged-in attacker can harvest sensitive files, including the connections configuration that stores encrypted database credentials, and potentially modify files to affect system integrity and availability. Any organization running a DbGate server/web deployment where untrusted users hold accounts is affected; desktop-only single-user installs have lower risk. No public proof-of-concept or in-the-wild exploitation is known, and CISA has not added it to the KEV catalog.

What to do: Monitor the DbGate project for a patched release and upgrade as soon as a fix is published, since no fixed version is specified in the available data. In the meantime, restrict the DbGate web interface to trusted, authenticated users, avoid exposing it directly to the internet, and place it behind a VPN or reverse proxy with access controls. Audit the connections configuration and other sensitive files on the host for signs of unauthorized access or modification.