Back to overview

CVE-2026-47670

CRITICAL
9.4
CVSS 4.0
Description
DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized `functionName` parameter in the `/runners/load-reader` endpoint. The `require = null` mitigation is trivially bypassed via dynamic `import()`. Version 7.1.9 contains a patch.

Metadata

CVE ID
CVE-2026-47670
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-05-19 21:10 UTC
Published
2026-07-23 19:12 UTC
Last updated
2026-07-23 19:12 UTC
Primary CWE
CWE-77
CWE-77: Improper Neutralization of Special Elements used in …
Vendor / Product
dbgate / dbgate
Sources
cve.org  ·  NVD

Severity & Metrics

9.4 CRITICAL CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products (1)
VendorProductPlatformVersions
dbgate dbgate — < 7.1.9
Weakness (CWE)
CWESourceDescription
CWE-77 cna CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-78 cna CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS scores (1)
ScoreSeverityVersionSourceVector
9.4 CRITICAL 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
References (2)
Back to overview