CVE-2026-47670

In DbGate, the unzipDirectory() function does not validate extracted file paths, allowing path traversal. In default Docker deployment, a network attacker can exploit this to execute arbitrary code as root.

DbGate, a cross-platform database manager, in versions 7.1.8 and prior contains a remote code execution vulnerability in the JSON script runner (POST /runners/start). Code injection occurs via the functionName parameter in JSON script assign commands, which is interpolated directly into dynamically generated JavaScript code. The code is executed in a forked Node.js child process. Version 7.1.9 contains a patch.

DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName() to bypass directory containment and access sensitive files including encrypted database credentials stored in connections configuration.

DbGate is a cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reader endpoint interpolates the functionName parameter directly into a JavaScript code template without sanitization. An authenticated user can inject arbitrary JavaScript code that executes on the server with full Node.js process privileges, bypassing sandbox restrictions.

DbGate versions 7.0.0 through 7.1.4 have a stored XSS vulnerability because attacker-controlled SVG icons are rendered as raw HTML without sanitization. In the web UI this allows script execution in another user's browser; in the Electron desktop app it can escalate to local code execution.