CVE-2025-50185

🗓️ 26 Jul 2025 03:34:43Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 15 Views🌐 WEB

DbGate versions 6.6.0 and below allow unauthorized file access through insufficient path validation.

Reporter	Title	Published	Views	Family All 9
CNNVD	DbGate 安全漏洞	26 Jul 202500:00	–	cnnvd
Cvelist	CVE-2025-50185 DbGate allows Unauthorized File Access via CSV Plugin	26 Jul 202503:34	–	cvelist
EUVD	EUVD-2025-22773	3 Oct 202520:07	–	euvd
NVD	CVE-2025-50185	26 Jul 202504:16	–	nvd
OSV	CVE-2025-50185 DbGate allows Unauthorized File Access via CSV Plugin	26 Jul 202503:34	–	osv
Positive Technologies	PT-2025-30949 · Dbgate · Dbgate +1	26 Jul 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-50185	28 Jul 202504:32	–	redhatcve
Snyk	Arbitrary File Write via Archive Extraction (Zip Slip)	26 Jul 202504:57	–	snyk
Vulnrichment	CVE-2025-50185 DbGate allows Unauthorized File Access via CSV Plugin	26 Jul 202503:34	–	vulnrichment

Vulners

Node

dbgate dbgateRange≤6.6.0

[
  {
    "vendor": "dbgate",
    "product": "dbgate",
    "versions": [
      {
        "version": "<= 6.6.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/dbgate/dbgate/security/advisories/GHSA-7x75-fmx7-q6h9
github	www.github.com/dbgate/dbgate/blob/v6.6.0/plugins/dbgate-plugin-csv/src/backend/reader.js

Parameter	Position	Path	Description	CWE
fileName	request body	/runners/load-reader	Unauthorized file access via plugin in DbGate by sending a fileName that points to sensitive system files; the request body contains the path and the application reads the file without proper validation.	CWE-29

15 Apr 2026 00:35Current

6.3Medium risk

Vulners AI Score6.3

CVSS 48.3

EPSS0.00509

SSVC

CWE-29