The vulnerability exists in the saveUploadedFile function of dbgate’s files.js component, allowing an attacker to manipulate the filePath/fileName arguments and perform path traversal. This flaw can enable arbitrary access to the server’s file system, potentially exposing sensitive data or compromising system integrity. The attack is remote, publicly documented, and has been demonstrated in the wild.

dbgate is affected on all releases up to 6.8.1, 7.0.2, 7.1.8, 7.2.5, and 7.3.1. No other vendors or product versions are listed as impacted.

The CVSS score of 6.9 indicates medium severity, and although an EPSS score is not available, the publicly available exploit and remote attack vector place this vulnerability at a substantial risk. The keyword KEV is not flagged, but the lack of a vendor response suggests that the issue may remain unpatched for some time.