H3-2026-1085¶
DbGate Arbitrary File Write via Export Endpoints
| Category | VULNERABILITY |
| Base Score | 9.9 |
Description¶
DbGate's export endpoints, including exportFile, exportChart, exportMap, and exportDiagram, accept a client supplied absolute filePath value and write server generated content to that location without confirming the path remains within the application's managed data directories. Remote attackers who can reach these endpoints can direct the write to an arbitrary filesystem location the DbGate process can access. The condition applies to non-Electron server and web deployments of DbGate, where the export API runs with the host filesystem permissions of the server process.
Impact¶
Remote attackers gain the ability to write files to arbitrary locations the DbGate server process can reach. This write primitive can overwrite cron jobs, SSH authorized_keys, or files served from a web root to pursue code execution. Data integrity on the host is no longer guaranteed. Server deployments exposing DbGate's export API face a credible path to full compromise.