CVE-2026-47669 DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE
A path traversal vulnerability in DbGate allows attackers to write arbitrary files via malicious ZIP archives, potentially leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47669?
CVE-2026-47669 is a critical path traversal vulnerability in dbgate, published on 23 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
DbGate is cross-platform database manager. In versions 7.1.8 and prior, the `unzipDirectory()` function in `packages/api/src/shell/unzipDirectory.js` (line 27) does not validate that extracted file paths stay within the output directory. A malicious ZIP with `../` entries writes files anywhere on the filesystem. In the default Docker deployment, DbGate runs as root and the `none` auth provider issues JWT tokens without credentials via `POST /auth/login`, so this is exploitable by any network-adjacent attacker. Version 7.1.9 fixes the issue.
Weakness: CWE-22
Which versions are affected by CVE-2026-47669?
2 open source packages ship an affected version, including dbgate.
| Package | Affected | Fixed in |
|---|---|---|
dbgate npm | All versions | 7.1.9 |
dbgate npm | All versions | 7.1.9 |
How do I fix CVE-2026-47669?
Upgrade dbgate to 7.1.9 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-47669 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-47669 exists.
Sources
Also known as GHSA-h535-j5hr-mv56.