CVE-2026-47669
9.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Summary
DbGate is cross-platform database manager. In versions 7.1.8 and prior, the unzipDirectory() function in packages/api/src/shell/unzipDirectory.js (line 27) does not validate that extracted file paths stay within the output directory. A malicious ZIP with ../ entries writes files anywhere on the filesystem. In the default Docker deployment, DbGate runs as root and the none auth provider issues JWT tokens without credentials via POST /auth/login, so this is exploitable by any network-adjacent attacker. Version 7.1.9 fixes the issue.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| dbgate | dbgate | < 7.1.9 | affected |
Weaknesses
- CWE-22: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
References
- https://github.com/dbgate/dbgate/security/advisories/GHSA-h535-j5hr-mv56
- https://github.com/dbgate/dbgate/releases/tag/v7.1.9
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.