CVE-2026-47669
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
In DbGate, the unzipDirectory() function does not validate extracted file paths, allowing path traversal. In default Docker deployment, a network attacker can exploit this to execute arbitrary code as root.
Risk Assessment
Risk of remote code execution with root privileges, leading to full container compromise.
Recommendation
Update DbGate to version 7.1.9 or later. Restrict network access to the service.
Original NVD description (English source)
DbGate is cross-platform database manager. In versions 7.1.8 and prior, the `unzipDirectory()` function in `packages/api/src/shell/unzipDirectory.js` (line 27) does not validate that extracted file paths stay within the output directory. A malicious ZIP with `../` entries writes files anywhere on the filesystem. In the default Docker deployment, DbGate runs as root and the `none` auth provider issues JWT tokens without credentials via `POST /auth/login`, so this is exploitable by any network-adjacent attacker. Version 7.1.9 fixes the issue.