Critical severity · published Jul 23, 2026
CVE-2026-47670
DbGate Vulnerable to Authenticated Remote Code Execution via loadReader functionName code injection
9.4
CVSS
1.8%
EPSS
No
On KEV
Description
DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized `functionName` parameter in the `/runners/load-reader` endpoint. The `require = null` mitigation is trivially bypassed via dynamic `import()`. Version 7.1.9 contains a patch.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DB
dbgate · dbgate
< 7.1.9 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-47670
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-47670
github.com
https://github.com/dbgate/dbgate/releases/tag/v7.1.9
github.com
https://github.com/dbgate/dbgate/security/advisories/GHSA-wm5r-5qp3-5vxf
More from dbgate
10.0
CVE-2026-47668
DbGate: Unauthenticated Remote Code Execution via JSON Script Runner
9.3
CVE-2026-47669
DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE
8.8
CVE-2026-85176
DbGate through 7.2.6 Arbitrary File Read and Write via file:// jslid
8.8
CVE-2026-48017
DbGate: Remote Code Execution via functionName injection in loadReader endpoint
8.2
CVE-2026-34725
dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration