DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE

Description

The unzipDirectory() function in packages/api/src/shell/unzipDirectory.js (line 27) does not validate that extracted file paths stay within the output directory. A malicious ZIP with ../ entries writes files anywhere on the filesystem.

Recommendation

Update the dbgate package to the latest compatible version. Followings are version details:

• Affected version(s): <= 7.1.8
• Patched version(s): 7.1.9

References

• GHSA-h535-j5hr-mv56
• CVE-2026-47669
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• @appium/support has a Zip Slip arbitrary file write in its ZIP extraction - CVE-2026-30973
• SillyTavern has a path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory - CVE-2026-34522
• Rollup 4 has Arbitrary File Write via Path Traversal - CVE-2026-27606
• SillyTavern: Path Traversal in `/api/chats/export` and `/api/chats/delete` allows arbitrary file read/delete within user - CVE-2026-34524

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

dbgate