CVE-2026-47670

CRITICAL NUCLEI

DbGate Vulnerable to Authenticated Remote Code Execution via loadReader functionName code injection

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-47670. PoCs published by error.inside. A Nuclei detection template is also available.

AI-analyzed exploit summary This PoC exploits an authenticated Remote Code Execution (RCE) vulnerability in DbGate versions prior to 7.1.9 via unsafe JavaScript code injection in the `/runners/load-reader` endpoint's `functionName` parameter. The exploit bypasses `require = null` mitigation using dynamic `import()` statements to execute arbitrary commands and retrieve output via a temporary JSONL file.

Description

DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized `functionName` parameter in the `/runners/load-reader` endpoint. The `require = null` mitigation is trivially bypassed via dynamic `import()`. Version 7.1.9 contains a patch.

Exploits (1)

gitlab WORKING POC
by error.inside · poc
https://gitlab.com/error.inside/CVE-2026-47670

This PoC exploits an authenticated Remote Code Execution (RCE) vulnerability in DbGate versions prior to 7.1.9 via unsafe JavaScript code injection in the `/runners/load-reader` endpoint's `functionName` parameter. The exploit bypasses `require = null` mitigation using dynamic `import()` statements to execute arbitrary commands and retrieve output via a temporary JSONL file.

Classification
Working Poc 98%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: DbGate < 7.1.9
Auth required
Prerequisites: Valid DbGate credentials (e.g., admin:admin) · Network access to the DbGate web interface · Target running a vulnerable version (< 7.1.9)
mistral-large-3 · analyzed Jul 24, 2026 Full analysis →

Nuclei Templates (1)

DbGate - Remote Code Execution via Dynamic Import Bypass
CRITICALVERIFIEDby theamanrawat
Shodan: http.title:"DbGate"
FOFA: title="DbGate"

References (2)

Core 2
Core References
X_Refsource_Misc x_refsource_misc
https://github.com/dbgate/dbgate/releases/tag/v7.1.9

Scores

CVSS v4 9.4
EPSS 0.0171
EPSS Percentile 75.0%
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-77 CWE-78
Status published
Products (1)
dbgate/dbgate < 7.1.9
Published Jul 23, 2026
Tracked Since Jul 24, 2026