DbGate is a cross‑platform database manager. In versions 7.1.8 and earlier, the unzipDirectory() function fails to constrain extracted files to the intended output directory. A malicious ZIP archive containing '../' path traversal entries can cause the application to write files anywhere on the filesystem. In the default Docker deployment, DbGate runs as root and the default authentication provider issues JWT tokens without requiring credentials via POST /auth/login. Therefore any network‑adjacent attacker can supply a crafted ZIP through the API and trigger arbitrary file writes, potentially leading to full remote code execution. The vulnerability corresponds to CWE‑22, an absolute path traversal flaw.

DbGate database manager version 7.1.8 and earlier are affected. The product is maintained by the vendor dbgate:dbgate. The vulnerability was fixed in version 7.1.9, which includes proper path validation and error handling during extraction.

The CVSS score of 9.3 indicates critical severity, yet the EPSS score is reported as < 1 %, indicating a low immediate probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. In the default Docker deployment, DbGate runs as root and the none authentication provider issues JWT tokens without requiring credentials via POST /auth/login. Consequently, any network‑adjacent attacker who can reach the container’s API can exploit the flaw by submitting a malicious ZIP archive and triggering arbitrary file writes with elevated privileges.