A critical path traversal vulnerability in DbGate allows unauthenticated attackers to execute arbitrary file writes, potentially leading to remote code execution.

The application fails to sanitize zip file paths in the unzipDirectory function, allowing a remote, unauthenticated attacker to escape the intended directory and overwrite system files.

By overwriting sensitive configuration or system files, an attacker could gain full control over the host environment. The 9.3 CVSS score highlights the severe impact, particularly in containerized deployments where the service may be running with elevated privileges.

Immediate Action: Update dbgate to version 7.1.9 or later to incorporate the necessary path validation fixes.

Proactive Monitoring: Monitor filesystem integrity and audit logs for unauthorized file modifications, particularly within system-critical directories.

Compensating Controls: Run the DbGate service with the principle of least privilege, ensuring it is not operating as root, to limit the impact of potential file traversal attempts.

Public Exploit Available: unknown

Administrators must treat this vulnerability with high urgency. Applying the patch to version 7.1.9 is the primary defense, and organizations should ensure that the service is isolated with appropriate user permissions to mitigate the risk of filesystem manipulation.