CVE-2026-101066 is a High (CVSS 7.3) path traversal in dbgate up to 7.3.1. The createLink function in archive link creation trusts the linkedFolder argument. The record says an exploit is public and the vendor did not respond. No fixed version is confirmed, so restrict network access.
What's affected
The weakness is CWE-22 (path traversal). The record says dbgate up to 7.3.1 is affected, in the createLink function of packages/api/src/controllers/archive.js, in the component that creates archive links. Changing the linkedFolder argument causes the traversal.
The record states that the attack may be initiated remotely, that the exploit has been publicly disclosed and may be used, and that the vendor was contacted early but did not respond in any way. The CVSS 3.1 vector is network, low complexity, no privileges, no user interaction, with low impact on confidentiality, integrity and availability.
We could not confirm a fixed version. The record's references are a write up by the reporter and VulDB entries, and the VulDB page would not load for us without a browser challenge. The record does not name a patched release, and says the vendor did not respond, so assume none exists until the project says otherwise. This is not the same as a confirmed unfixed state, so check the project's repository and releases page.
The record does not mark the CVE as known exploited by CISA. Public exploit disclosure is a different thing, and it does raise the chance of attempts.
How to check if you're exposed
Find your dbgate version. In the desktop app it is under the About dialog. In the web or Docker deployment, check the image tag or the package version.
docker image ls | grep -i dbgate
If it is 7.3.1 or earlier, you are in range. Next, ask how the service is reached. dbgate is a database management tool, so it normally sits next to credentials for your databases. A web deployment that is reachable from the internet, or from a broad internal network, is the one to look at first.
Look at the file system around the service too. Review which directories the process can read and write, and whether it runs as a restricted user.
The free in-browser dependency scan at gold.safeguard.sh/scan can match a lockfile or manifest against known CVEs without installing anything. The Gold directory page for each CVE lists affected packages and fixes as they are published.
What to do now
- List dbgate deployments and their versions.
- Take web or server deployments off the internet. Put them behind a VPN or an authenticating reverse proxy.
- Run the process as a low privilege user, in a container with only the volumes it needs.
- Check the project repository and releases for a version newer than 7.3.1 that addresses the archive link issue.
- Rotate database credentials stored in any instance that was exposed.
Why it matters
Path traversal lets a request name files outside the folder the program meant to use. For a tool that manages databases and stores connection details, reading or writing the wrong file can expose credentials or change configuration.
The practical risk here is made worse by two things in the record: the exploit is public and there is no vendor response. That combination calls for network controls rather than waiting for a patch.
Quick check
Is there a patch?
We could not confirm one. The record says the vendor did not respond to the disclosure. Check the dbgate repository and releases for a version after 7.3.1.
Is this exploited in the wild?
The record does not mark it as known exploited. It does say the exploit is public, which raises the likelihood of attempts.
Sources
- Reporter write up (listed in the record)
- VulDB entry (listed in the record; blocked by a browser check when we tried it)
Last reviewed: 18 October 2026.
