Path Traversal Vulnerability in dbgate by Genesi
CVE-2026-101068

6.9MEDIUM

Key Information:

Vendor: Genesi
Status: Dbgate
Vendor: CVE Published:; 28 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-101068?

A security flaw has been identified in dbgate, impacting versions up to 7.3.1. The vulnerability resides in the zipJsonLinesData function, specifically within the Create Connection Endpoint. An attacker may manipulate the argument filePath to execute a path traversal attack, which could allow unauthorized access to files on the server. The exploit has been made public, raising alarm about potential remote exploitation. Although there were enhancements to secure other export endpoints, this particular endpoint remains vulnerable. Despite efforts to notify the vendor regarding this issue, no response has been provided.

Affected Version(s)

dbgate 7.3.0

dbgate 7.3.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-101068 - Proof of Concept