Description
The unzipDirectory() function in packages/api/src/shell/unzipDirectory.js (line 27) does not validate that extracted file paths stay within the output directory. A malicious ZIP with ../ entries writes files anywhere on the filesystem.
Recommendation
Update the dbgate package to the latest compatible version. Followings are version details:
- Affected version(s): <= 7.1.8
- Patched version(s): 7.1.9
References
Could your website be exposed too?
SmartScanner can check your website for DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @appium/support has a Zip Slip arbitrary file write in its ZIP extraction - CVE-2026-30973
- SillyTavern has a path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory - CVE-2026-34522
- Rollup 4 has Arbitrary File Write via Path Traversal - CVE-2026-27606
- SillyTavern: Path Traversal in `/api/chats/export` and `/api/chats/delete` allows arbitrary file read/delete within user - CVE-2026-34524
You might also like:
See something that needs correcting? Let us knowUpdated June 05, 2026