CVE-2026-47670CWE-77CWE-78

DbGate Vulnerable to Authenticated Remote Code Execution via loadReader functionName code injection

Critical · published July 23, 2026

CVSS v4.0
9.4
EPSS
2%
Percentile
77.8
In the wild
Unconfirmed
What it is

DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized `functionName` parameter in the `/runners/load-reader` endpoint. The `require = null` mitigation is trivially bypassed via dynamic `import()`. Version 7.1.9 contains a patch.

The record
Technical detail
CVSS v4.0
9.4 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.01757 · 77.8th percentile
Weaknesses
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection'); CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-07-23T19:12Z
EPSS history
Timeline
  • 23 JUL 19:12Z
    DbGate Vulnerable to Authenticated Remote Code Execution via loadReader functionName code injection
    cvelistv5