PT-2026-47093 · Dbgate+2 · Dbgate+1

CVE-2026-48017

·

Published

2026-06-05

·

Updated

2026-06-16

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions DbGate versions prior to 7.1.9
Description The "POST /runners/load-reader" endpoint accepts a functionName parameter that is directly interpolated into a JavaScript code template without sanitization or validation. An authenticated user with basic access can inject arbitrary JavaScript code that executes on the server with full process privileges, bypassing the require=null sandbox restriction. This allows the attacker to execute arbitrary OS commands with the privileges of the Node.js process, read or write any file accessible to the process, and pivot to connected databases by accessing connection credentials from storage. In Docker deployments, this can lead to root access within the container.
Recommendations Update to version 7.1.9 or later. As a temporary workaround, restrict access to the "POST /runners/load-reader" endpoint to minimize the risk of exploitation.

Exploit

Fix

RCE

Code Injection

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2026-48017
GHSA-HV83-GGC4-V385

Affected Products

Dbgate
Dbgate-Api