CyberRota Analysis
AI-GeneratedVersions 7.1.8 and earlier of DbGate, a cross-platform database manager running in Docker, are vulnerable due to improper validation in the `unzipDirectory()` function, allowing attackers to extract files outside the intended directory using malicious ZIP files. This vulnerability poses a significant risk as it can lead to arbitrary file writes on the filesystem, particularly since DbGate operates with root privileges by default. Organizations using DbGate in Docker should prioritize upgrading to version 7.1.9 to mitigate this risk, especially those with network exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
DbGate is cross-platform database manager. In versions 7.1.8 and prior, the `unzipDirectory()` function in `packages/api/src/shell/unzipDirectory.js` (line 27) does not validate that extracted file paths stay within the output directory. A malicious ZIP with `../` entries writes files anywhere on the filesystem. In the default Docker deployment, DbGate runs as root and the `none` auth provider issues JWT tokens without credentials via `POST /auth/login`, so this is exploitable by any network-adjacent attacker. Version 7.1.9 fixes the issue.