CVE-2026-75855
Received Received - Intake

ArcadeDB Path Traversal in Database Operations

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: VulnCheck

Description
ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names containing ../ sequences to create databases at arbitrary filesystem paths or recursively delete directories the server process can access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-75855
EUVD
EUVD-2026-60616

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
arcadedb arcadedb to 26.8.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-75855 is a Path Traversal vulnerability in ArcadeDB versions before 26.8.1. It allows authenticated root users to exploit the create and drop database commands by supplying database names with ../ sequences. This bypasses path restrictions, enabling file writes outside the database directory or deletion of arbitrary files the server can access.

Detection Guidance

Check ArcadeDB server logs for suspicious database creation or deletion requests containing '../' sequences. Inspect filesystem for unexpected files or directories created outside the database directory. Use network monitoring tools to detect POST requests to /api/v1/server with malformed database names.

Impact Analysis

An attacker could create or delete files anywhere the server process has permissions. This may lead to code execution, denial of service, or data destruction. For example, overwriting critical system files or deleting database contents could disrupt operations or enable further attacks.

Compliance Impact

This vulnerability could violate GDPR or HIPAA by enabling unauthorized data access, modification, or deletion. It undermines integrity and availability requirements, potentially leading to data breaches or loss of protected health information.

Mitigation Strategies

Upgrade ArcadeDB to version 26.8.1 or later immediately. Implement input validation to reject database names containing path separators like '../'. Restrict server process permissions to limit file system access. Monitor for unauthorized file creation or deletion activities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75855. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart