CVE-2026-97226CWE-22path-traversal

CVE-2026-97226

Medium · published September 24, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
26.1
In the wild
Unconfirmed
What it is

A vulnerability has been found in DbGate up to 7.2.5/7.3.1-premium-beta.1. This impacts the function fs.readFile of the file packages/api/src/controllers/files.js of the component files-style Endpoint. The manipulation of the argument filePath/uri leads to path traversal. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
EPSS
0.00339 · 26.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-09-24T20:17Z
References (4)
https://vuldb.com/cve/CVE-2026-97226 · [email protected]https://vuldb.com/submit/908139 · [email protected]https://vuldb.com/vuln/409320 · [email protected]https://vuldb.com/vuln/409320/cti · [email protected]
EPSS history
Timeline
  • 26 SEP 03:27Z
    EPSS moved — → 0%
    epss
  • 24 SEP 15:45Z
    DbGate files-style Endpoint files.js fs.readFile path traversal
    cvelistv5