# CVE-2026-47669: DbGate path traversal in unzipDirectory archive extraction

Source: https://junglewise.ai/threats/cve-2026-47669-dbgate-path-traversal-in-unzipdirectory-archive-extraction  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-47669 · Severity: critical · CVSS 4 · Published 2026-07-23

DbGate is a database management tool used to connect to and administer various database systems. A security flaw in its file extraction process allows an attacker to write malicious files anywhere on the server's filesystem. In common setups, this can lead to a complete takeover of the application and the underlying server, potentially exposing sensitive database credentials and customer data.

Technologies: [DbGate](https://junglewise.ai/threats/technologies/dbgate). Vendors: [DbGate](https://junglewise.ai/threats/vendors/dbgate), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-47669 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47669 being exploited in the wild.

**How severe is CVE-2026-47669?** Critical severity, with a CVSS score of 4, published 23 July 2026.

**Which products and versions are affected?** DbGate <= 7.1.8; dbgate (npm) SEMVER:introduced=0,fixed=7.1.9.

**Is there a fix for CVE-2026-47669?** Yes. dbgate (npm): upgrade to 7.1.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47669 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-47669?** Check whether you run DbGate or dbgate (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- dbgate (npm): upgrade to 7.1.9 or later

  ```sh
  npm install dbgate@7.1.9
  ```


## Technical details

A 'Zip Slip' path traversal vulnerability exists in the `unzipDirectory()` function within `packages/api/src/shell/unzipDirectory.js`. The function fails to validate that extracted file paths remain within the intended output directory, allowing a malicious ZIP archive containing `../` sequences to write files to arbitrary locations. In default Docker deployments, the application runs as root and uses a 'none' authentication provider that issues JWT tokens without credentials. An attacker can exploit this by uploading a crafted ZIP and triggering the unzip endpoint to achieve remote code execution (e.g., by writing to `/etc/cron.d/`). The issue is fixed in version 7.1.9.

## Affected products

- DbGate DbGate <= 7.1.8

## Identifiers

- CVE-2026-47669
- GHSA-h535-j5hr-mv56

## Timeline

- 2026-04-22: patched: Version 7.1.9 released
- 2026-05-20: advisory: GitHub Security Advisory published
- 2026-07-23: disclosed: CVE published to NVD

## References

- [https://github.com/dbgate/dbgate/releases/tag/v7.1.9](https://github.com/dbgate/dbgate/releases/tag/v7.1.9)
- [https://github.com/dbgate/dbgate/security/advisories/GHSA-h535-j5hr-mv56](https://github.com/dbgate/dbgate/security/advisories/GHSA-h535-j5hr-mv56)

## Related threats

- [DbGate missing authorization in connection management](https://junglewise.ai/threats/cve-2026-121455-dbgate-before-7-3-3-contains-a-missing-authorization)
- [DbGate path traversal in Files Endpoint](https://junglewise.ai/threats/cve-2026-101070-a-security-vulnerability-has-been-detected-in-dbgate-up-to-7-3-1)
- [DbGate arbitrary file write via path traversal in exportModelSql](https://junglewise.ai/threats/cve-2026-101069-a-weakness-has-been-identified-in-dbgate-up-to-7-3-1-affected-is)
- [DbGate path traversal in Create Connection Endpoint](https://junglewise.ai/threats/cve-2026-101068-a-security-flaw-has-been-discovered-in-dbgate-up-to-7-3-1-this)
- [DbGate path traversal in save-uploaded-file endpoint](https://junglewise.ai/threats/cve-2026-101067-a-vulnerability-was-identified-in-dbgate-up-to-6-8-1-7-0-2-7-1-8)