CVE-2026-47670
CriticalCVSS 9.4Exploitation Probability (EPSS)
High risk75th percentile - higher than 75% of all known CVEs
Summary
DbGate versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized functionName parameter in the /runners/load-reader endpoint. The require = null mitigation is trivially bypassed via dynamic import(). Version 7.1.9 contains a patch.
Risk Assessment
An authenticated attacker can gain full root-level control over the DbGate server, leading to data theft, database modification, and further attacks.
Recommendation
Immediately update DbGate to version 7.1.9 or later, which contains the fix.
Original NVD description (English source)
DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized `functionName` parameter in the `/runners/load-reader` endpoint. The `require = null` mitigation is trivially bypassed via dynamic `import()`. Version 7.1.9 contains a patch.