CVE-2026-47670: critical vulnerability in dbgate
DbGate Vulnerable to Authenticated Remote Code Execution via loadReader functionName code injection
Published · Updated
63Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 9.4epss 1.8%
from disclosure to weapon0 days
Published on NVDJul 23
1st PoCJun 18
exploitation probability
1.8%top 22% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized `functionName` parameter in the `/runners/load-reader` endpoint. The `require = null` mitigation is trivially bypassed via dynamic `import()`. Version 7.1.9 contains a patch.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
dbgate · dbgatepublic PoCs found — 1
githubgithub.com/error-inside/CVE-2026-47670★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — dbgate
In the same product, most dangerous first.
CVE-2026-47668CRITICALDbGate: Unauthenticated Remote Code Execution via JSON Script RunnerEPSS 3.9%CVE-2026-85176HIGHDbGate through 7.2.6 Arbitrary File Read and Write via file:// jslidEPSS 0.6%CVE-2025-50184HIGHDbGate allows for File Traversal via file parameterEPSS 0.6%CVE-2026-47669CRITICALDbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCEEPSS 0.5%CVE-2026-48017HIGHDbGate: Remote Code Execution via functionName injection in loadReader endpointEPSS 0.5%CVE-2025-50185HIGHDbGate allows Unauthorized File Access via CSV PluginEPSS 0.4%