DbGate up to 7.1.8 ZIP unzipDirectory.js unzipDirectory path traversal

Summaryinfo

A vulnerability classified as very critical has been found in DbGate up to 7.1.8. This impacts the function unzipDirectory of the file packages/api/src/shell/unzipDirectory.js of the component ZIP Handler. The manipulation leads to path traversal. This vulnerability is uniquely identified as CVE-2026-47669. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in DbGate up to 7.1.8. It has been rated as very critical. This issue affects the function unzipDirectory of the file packages/api/src/shell/unzipDirectory.js of the component ZIP Handler. The manipulation with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the `unzipDirectory()` function in `packages/api/src/shell/unzipDirectory.js` (line 27) does not validate that extracted file paths stay within the output directory. A malicious ZIP with `../` entries writes files anywhere on the filesystem. In the default Docker deployment, DbGate runs as root and the `none` auth provider issues JWT tokens without credentials via `POST /auth/login`, so this is exploitable by any network-adjacent attacker. Version 7.1.9 fixes the issue.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-47669 since 05/19/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/23/2026). The attack technique deployed by this issue is T1006 according to MITRE ATT&CK.

Upgrading to version 7.1.9 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• DbGate

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4
• 7.1.5
• 7.1.6
• 7.1.7
• 7.1.8

Website

• Product: https://github.com/dbgate/dbgate/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion