DbGate fails to validate the jslid parameter in the jsldata controller, allowing authenticated users to read and write arbitrary files through the file:// scheme. The vulnerability enables an attacker to bypass directory containment and gain access to sensitive files, such as encrypted database credentials stored in connection configurations. The flaw is a classic instance of a file path traversal issue (CWE-73), giving attackers potential to compromise confidentiality and integrity of stored data.

The affected product is DbGate version 7.2.6 and earlier. Any deployment using these versions is vulnerable. No specific distribution details are provided beyond the vendor listing.

The CVSS score of 8.7 indicates a high severity. EPSS is not available, so the current likelihood of exploitation is unknown, and the vulnerability is not listed in the KEV catalog. The attack requires authentication within DbGate, so privileged users or compromised accounts may exploit the flaw. The exploit can be performed by calling the getJslFileName() routine with crafted jslid values to read or overwrite arbitrary files, which can lead to credential theft or modification of application state.