DbGate EUVD-2026-22087

Exploitation requires the attacker to hold at minimum a low-privileged authenticated session in DbGate (CVSS PR:L), ruling out unauthenticated remote exploitation. A victim user must also interact with or view the component rendering the malicious applicationIcon value (CVSS UI:P), meaning passive delivery is insufficient. The vulnerability is constrained to the SVG Icon String Handler in FontIcon.svelte; deployments where the applicationIcon parameter cannot be set by lower-privileged users, or where the web interface is network-restricted to trusted administrators only, face materially reduced risk. No special non-default configuration is required beyond standard DbGate web interface deployment.

The composite risk picture is low-to-moderate. The official CVSS 4.0 base score is 2.0, reflecting authentication requirements (PR:L), the need for victim interaction (UI:P), and a limited integrity-only impact confined to the vulnerable system (VI:L, no confidentiality or availability impact, no subsequent-system impact). EPSS at 0.03% places this vulnerability in the 9th percentile of exploitation likelihood, indicating that automated or opportunistic exploitation is highly unlikely. SSVC corroborates this: exploitation is assessed as none, the attack is not automatable, and technical impact is only partial. DbGate is not listed in the CISA KEV catalog. The public POC elevates residual risk slightly above zero - a determined attacker with authenticated access could leverage the disclosed technique - but the PR:L and UI:P gating conditions meaningfully reduce the realistic attack surface. The low CVSS score and low EPSS are consistent and mutually reinforcing here; this is not a case of conflicting signals.

An authenticated DbGate user crafts a malicious applicationIcon string embedding a JavaScript payload and sets or shares it within the application interface. When a second authenticated user navigates to or interacts with the component rendering the malicious icon via FontIcon.svelte, the injected script executes in their browser, potentially enabling session token theft or unauthorized DOM manipulation. A public proof-of-concept has been disclosed via VulDB submission 785841, lowering the skill threshold for exploitation against unpatched instances.