CVE-2025-50185

🗓️ 26 Jul 2025 03:34:43Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 49 Views🌐 WEB

DbGate versions 6.6.0 and below allow unauthorized file access through insufficient path validation.

Reporter	Title	Published	Views	Family All 10
CNNVD	DbGate security vulnerability	26 Jul 202500:00	–	cnnvd
Cvelist	CVE-2025-50185 DbGate allows Unauthorized File Access via CSV Plugin	26 Jul 202503:34	–	cvelist
EUVD	EUVD-2025-22773	3 Oct 202520:07	–	euvd
Mend	CVE-2025-50185	26 Jul 202503:34	–	mend
NVD	CVE-2025-50185	26 Jul 202504:16	–	nvd
Positive Technologies	PT-2025-30949 · Dbgate · Dbgate +1	26 Jul 202500:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2025-50185: Path Traversal: '\..\filename'	26 Jul 202500:00	–	rapid7
RedhatCVE	CVE-2025-50185	28 Jul 202504:32	–	redhatcve
Snyk	Arbitrary File Write via Archive Extraction (Zip Slip)	26 Jul 202504:57	–	snyk
Vulnrichment	CVE-2025-50185 DbGate allows Unauthorized File Access via CSV Plugin	26 Jul 202503:34	–	vulnrichment

Vulners

Node

dbgate dbgateRange≤6.6.0

[
  {
    "vendor": "dbgate",
    "product": "dbgate",
    "versions": [
      {
        "version": "<= 6.6.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/dbgate/dbgate/blob/v6.6.0/plugins/dbgate-plugin-csv/src/backend/reader.js
github	www.github.com/dbgate/dbgate/security/advisories/GHSA-7x75-fmx7-q6h9

Parameter	Position	Path	Description	CWE
props.fileName	request body	/runners/load-reader	Insufficient validation of file paths and types in the load-reader function allows unauthorized access to arbitrary files on the system, such as /etc/shadow.	CWE-29

17 Jun 2026 09:34Current

5.9Medium risk

Vulners AI Score5.9

CVSS 48.3

EPSS0.00439

SSVC

CWE-29