CVE-2026-47669 in DbGate
Summary
by MITRE • 07/23/2026
DbGate is cross-platform database manager. In versions 7.1.8 and prior, the `unzipDirectory()` function in `packages/api/src/shell/unzipDirectory.js` (line 27) does not validate that extracted file paths stay within the output directory. A malicious ZIP with `../` entries writes files anywhere on the filesystem. In the default Docker deployment, DbGate runs as root and the `none` auth provider issues JWT tokens without credentials via `POST /auth/login`, so this is exploitable by any network-adjacent attacker. Version 7.1.9 fixes the issue.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/23/2026
The vulnerability described represents a critical directory traversal flaw in DbGate versions 7.1.8 and earlier, specifically within the unzipDirectory() function that processes ZIP file extraction operations. This security weakness stems from inadequate input validation mechanisms that fail to verify whether extracted file paths remain confined to the designated output directory. The absence of proper path sanitization allows malicious actors to exploit symbolic link sequences such as "../" within ZIP archive entries, enabling arbitrary file system write operations beyond the intended extraction boundaries.
The technical implementation flaw resides in the shell/unzipDirectory.js file where the unzipDirectory() function processes compressed archives without implementing proper containment checks on file paths. This vulnerability operates at the core of DbGate's archive handling functionality and represents a classic path traversal attack vector that has been categorized under CWE-22 - Improper Limitation of a Pathname to a Restricted Directory. The flaw specifically manifests when the application extracts files from untrusted ZIP archives without validating that destination paths remain within the expected directory structure.
The operational impact of this vulnerability is severe, particularly in default Docker deployments where DbGate executes with root privileges. This elevated privilege level combined with the absence of authentication requirements for the login endpoint at POST /auth/login creates an exploitable condition where any network-adjacent attacker can leverage this weakness without requiring valid credentials. The combination of privileged execution context with unauthenticated access points transforms a directory traversal vulnerability into a critical remote code execution threat, allowing attackers to write malicious files anywhere within the system filesystem.
This vulnerability aligns with several ATT&CK framework techniques including T1059 - Command and Scripting Interpreter and T1566 - Phishing, as attackers could potentially use this weakness to deploy malicious payloads or establish persistence mechanisms. The security implications extend beyond simple file system manipulation to include potential privilege escalation scenarios where attackers might exploit the root execution context to gain further system control. Additionally, this flaw demonstrates poor input validation practices that should be addressed through proper path normalization and containment checks.
The recommended mitigation strategy involves upgrading to DbGate version 7.1.9 or later, which implements proper file path validation mechanisms to prevent directory traversal attacks. Organizations should also consider implementing additional security controls such as running DbGate with reduced privileges, implementing network segmentation to limit access to the application, and establishing proper authentication requirements for all endpoints. The fix addresses the core issue by ensuring that extracted file paths are properly validated against the intended output directory, preventing any attempts to write files outside of the designated extraction boundaries.