PT-2025-30949 · Dbgate · Dbgate-Plugin-Csv+1

Published 2025-07-26 · Updated 2025-07-26 · CVE-2025-50185

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions DbGate versions 6.6.0 and below

Description DbGate, a cross-platform database manager, allows unauthorized file access due to insufficient validation of file paths and types. A user with application-level access can retrieve data from arbitrary files on the system, regardless of their location or file type. The plugin fails to enforce proper checks on content type and file extension before reading a file. This allows even sensitive files accessible only to the root user to be read through the application interface. The request is made via a POST request to the /runners/load-reader API endpoint, utilizing the reader@dbgate-plugin-csv function and the fileName parameter to specify the file path.

Recommendations DbGate versions prior to 6.6.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-29

Related Identifiers

CVE-2025-50185

GHSA-7X75-FMX7-Q6H9

Affected Products

Dbgate

Dbgate-Plugin-Csv

References · 7

• 🔥 https://github.com/dbgate/dbgate/security/advisories/GHSA-7x75-fmx7-q6h9 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/50xxx/CVE-2025-50185.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-50185 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-50185 · Security Note
• https://github.com/dbgate/dbgate/blob/v6.6.0/plugins/dbgate-plugin-csv/src/backend/reader.js#L71-L102 · Note
• https://twitter.com/VulmonFeeds/status/1949007725939040335 · Twitter Post
• https://twitter.com/CVEnew/status/1948976643663405123 · Twitter Post