## https://sploitus.com/exploit?id=137191A6-C394-5D6E-9B07-45CC6A106B74
CVE-2026-47668
---
Unauthenticated RCE in DBGate <= 7.1.8
* REF1: https://github.com/dbgate/dbgate/security/advisories/GHSA-8v3q-9vmx-36vc
* REF2: https://github.com/Nxploited/CVE-2026-47668
**`rce.py`**
Minimal implementation of RCE on `/runners/start`,
__Privileged__
If process can write to `./public/` folder, file `/favicon.svg` is used to retrieve command output.
```
$ rce.py whoami
root
```
If not, then command will run blind:
```
./rce.py -b sleep 300
```
**`run.sh` / `shell.sh`**
Run local containers using podman, check UID variable to run process with distinct privileges.