CVE-2026-18274
Received Received - Intake

Directory Traversal in Heimdall Data Database Proxy Leading to RCE

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: Zero Day Initiative

Description
Heimdall Data Database Proxy uploadJar Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Heimdall Data Database Proxy. Authentication is required to exploit this vulnerability. The specific flaw exists within the uploadJar method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-28603.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-18274
EUVD
EUVD-2026-63422

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
heimdall_data database_proxy *
heimdall_data database_proxy to 25.03.01.24 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a directory traversal vulnerability in Heimdall Data Database Proxy's uploadJar method. It allows authenticated remote attackers to execute arbitrary code with root privileges due to improper path validation before file operations.

Detection Guidance

Detection requires checking if your Heimdall Data Database Proxy version is prior to 25.03.01.24. Verify the software version installed on your system. If vulnerable, inspect network traffic for uploadJar method usage with suspicious path parameters.

Impact Analysis

An attacker could exploit this to run malicious code on your system with highest privileges, potentially stealing data, installing malware, or disrupting services. Requires authentication but can lead to full system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Full system compromise may also breach compliance controls.

Mitigation Strategies

Immediately update Heimdall Data Database Proxy to version 25.03.01.24 or later. If updating is not possible, restrict network access to the proxy and ensure strong authentication is enforced to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18274. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart