PT-2025-30948 · Dbgate · Dbgate

4Rdr · Published 2025-07-26 · Updated 2025-07-26 · CVE-2025-50184

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions DbGate versions 6.4.3-premium-beta.5 and below

Description DbGate is vulnerable to a directory traversal flaw. The file parameter is not properly restricted to the intended uploads directory. This allows manipulation of the endpoint that lists files within the upload directory to access arbitrary files on the system. By supplying a crafted path to the file parameter, an attacker can read files outside the upload directory, potentially exposing sensitive system-level data.

Recommendations Update to DbGate version 6.4.3-beta.8 or later.

Exploit

Fix

Weakness Enumeration

CWE-29

Related Identifiers

CVE-2025-50184

GHSA-2FP9-29GV-P5GM

Affected Products

Dbgate

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/50xxx/CVE-2025-50184.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-50184 · Security Note
• https://osv.dev/vulnerability/CVE-2025-50184 · Vendor Advisory
• https://github.com/dbgate/dbgate/security/advisories/GHSA-2fp9-29gv-p5gm · Note
• https://github.com/dbgate/dbgate/commit/18b11df672b5a887bc17a6b9fdd13f9742c8f98e · Note
• https://twitter.com/CVEnew/status/1948976653129990186 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1949010285701804357 · Twitter Post