Summary
A path traversal vulnerability in dbgate's Archive Link Creation functionality allows remotely supplied path data to influence the location targeted by the createLink function. An attacker who can reach the affected endpoint may use crafted linkedFolder input to access or manipulate files outside the intended directory, depending on deployment permissions.
Affected context
The vulnerability occurs in dbgate deployments using the Archive Link Creation component and the createLink function in packages/api/src/controllers/archive.js. It becomes risky when the remotely reachable functionality accepts a user-influenced linkedFolder value without reliably constraining the resolved path to an approved archive directory.
Exploit preconditions
- Attack surface: The remotely accessible Archive Link Creation functionality
- Required access: Network reachability to the affected dbgate interface; authentication requirements depend on deployment configuration
- Trigger point: Processing the
linkedFolderargument by thecreateLinkfunction - Why exploitation is possible: User-controlled path components may be interpreted as filesystem navigation rather than being restricted to the intended directory
Why this happens
The underlying bug is insufficient validation and canonicalization of a filesystem path assembled from attacker-influenced input. When directory traversal elements are accepted without resolving the final path and verifying that it remains within an approved base directory, the application may operate on resources outside its intended scope. This behavior maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly called path traversal.
Potential impact
- An attacker may access files outside the intended archive location
- Sensitive configuration, application, or credential data could be exposed
- Unauthorized files or links could be created or modified, depending on process permissions
- The application or host environment could be compromised further through exposed secrets
- Availability or data integrity could be affected
General mitigation guidance
Mitigation generally focuses on reducing filesystem trust in user-supplied paths and enforcing containment after path resolution.
Common defensive patterns include:
- Resolving candidate paths against a fixed, approved base directory and rejecting paths that escape it
- Allowing opaque identifiers or server-managed archive names instead of raw filesystem paths
- Applying strict input validation and rejecting traversal markers, absolute paths, and unexpected separators
- Using allowlisted directories and operation-specific permissions
- Running the service with the least filesystem privileges required
- Avoiding symbolic-link escapes through appropriate link handling and post-resolution containment checks
- Returning generic errors that do not disclose sensitive filesystem details
How teams detect issues like this
Detection approaches may include:
- Static analysis for filesystem APIs receiving request parameters or other untrusted values
- Code review checks for path concatenation without canonicalization and base-directory containment validation
- Testing with traversal-oriented path cases, absolute paths, encoded separators, and symbolic-link scenarios
- Runtime monitoring for unusual archive-link requests and access outside approved directories
- Policy enforcement requiring security-reviewed wrappers for filesystem path operations
- Automated code review or SAST tools configured to flag CWE-22 patterns
