CVE-2026-85176
DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName() to bypass directory containment and access sensitive files including encrypted database credentials stored in connections configuration.
Zwakheid
DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName() to bypass directory containment and access sensitive files including encrypted database credentials stored in connections configuration.
Bronnen
- https://github.com/dbgate/dbgate
- https://github.com/dbgate/dbgate/blob/v7.2.6/packages/api/src/controllers/jsldata.js
- https://github.com/dbgate/dbgate/blob/v7.2.6/packages/api/src/utility/getJslFileName.js
- https://github.com/dbgate/dbgate/issues/1502
- https://www.vulncheck.com/advisories/dbgate-through-7.2.6-arbitrary-file-read-and-write-via-file-jslid
Vind de bug voordat een aanvaller dat doet.
Log in met GitHub en start je eerste audit binnen een minuut. Voor het gratis abonnement is geen creditcard nodig.