Arbitrary File Read and Write Vulnerability in DbGate

CVE-2026-85176

What is CVE-2026-85176?

The DbGate product exhibits a severe security vulnerability whereby it improperly validates jslid parameters in the jsldata controller. Authenticated users can exploit this flaw to read and write arbitrary files using the file:// scheme resolution. This vulnerability allows attackers to bypass directory containment and potentially access sensitive information, such as encrypted database credentials stored within the connections configuration, through the compromised function getJslFileName().

References