PT-2026-47093 · Dbgate+2 · Dbgate+1
CVE-2026-48017
·
Published
2026-06-05
·
Updated
2026-06-16
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
DbGate versions prior to 7.1.9
Description
The "POST /runners/load-reader" endpoint accepts a
functionName parameter that is directly interpolated into a JavaScript code template without sanitization or validation. An authenticated user with basic access can inject arbitrary JavaScript code that executes on the server with full process privileges, bypassing the require=null sandbox restriction. This allows the attacker to execute arbitrary OS commands with the privileges of the Node.js process, read or write any file accessible to the process, and pivot to connected databases by accessing connection credentials from storage. In Docker deployments, this can lead to root access within the container.Recommendations
Update to version 7.1.9 or later.
As a temporary workaround, restrict access to the "POST /runners/load-reader" endpoint to minimize the risk of exploitation.
Exploit
Fix
RCE
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Dbgate
Dbgate-Api