CVE-2026-47669 dbgate CVE debrief

Who should care

Users of DbGate versions 7.1.8 and prior, especially those using the default Docker deployment, should upgrade to version 7.1.9 or later and restrict network access to DbGate. Additionally, operators, platform administrators, vulnerability management teams, and security teams should review system configurations, monitor for suspicious activity, and implement compensating controls as needed to mitigate potential impacts. Affected systems may be widespread, and prioritization of patching and mitigation efforts is crucial to minimize potential damage. Security teams should also review and update incident response plans to address potential exploitation of this vulnerability. DbGate users should also consider implementing additional authentication mechanisms and inventory and patch vulnerable systems promptly. Network-adjacent attackers could exploit this vulnerability without credentials, making swift action essential to protect against potential attacks. The CVE record was published on 2026-07-23T20:17:08.357Z and has not been modified since then. The NVD entry is currently Deferred. Users should also consider reviewing CVE-2026-47669 official CVE record and CVE-2026-47669 NVD detail for further information. DbGate security advisory may provide additional context for affected users. Users should also review DbGate v7.1.9 release notes for patch details. This vulnerability has a CVSS score of 9.3 and a CRITICAL severity rating, emphasizing the need for prompt action to mitigate potential impacts. Users of DbGate should prioritize patching and mitigation efforts based on their specific deployment configurations and risk assessments. The default Docker deployment runs DbGate as root, which may increase the potential impact of exploitation. Therefore, users should take extra precautions to secure their deployments and limit potential damage. Users should also consider implementing monitoring and detection mechanisms to identify potential exploitation attempts. By taking swift action and implementing recommended mitigations, users can minimize the potential impact of this vulnerability and protect their systems against potential attacks. The CVE-2026-47669 CVE record,

Technical summary

The `unzipDirectory()` function in `packages/api/src/shell/unzipDirectory.js` (line 27) of DbGate versions 7.1.8 and prior does not validate extracted file paths, allowing a malicious ZIP with `../` entries to write files anywhere on the filesystem. In the default Docker deployment, DbGate runs as root and the `none` auth provider issues JWT tokens without credentials via `POST /auth/login`, making it exploitable by any network-adjacent attacker.

Defensive priority

Critical vulnerability in DbGate, a cross-platform database manager, allowing arbitrary file writes on the filesystem via a malicious ZIP file.

Recommended defensive actions

• Upgrade to DbGate version 7.1.9 or later
• Restrict network access to DbGate
• Implement additional authentication mechanisms
• Monitor for suspicious activity
• Inventory and patch vulnerable systems

Evidence notes

The `unzipDirectory()` function in DbGate versions 7.1.8 and prior does not validate extracted file paths, allowing writes anywhere on the filesystem. In the default Docker deployment, DbGate runs as root, making it exploitable by any network-adjacent attacker without credentials. Evidence is limited to public sources and may not cover all affected systems or potential impacts. Defenders should verify system configurations, monitor for suspicious activity, and review relevant logs for potential exploitation attempts.

Official resources