CyberRota Analysis
AI-GeneratedArcadeDB versions prior to 26.8.1 are vulnerable due to insufficient sanitization of database names in the create and drop database commands, enabling authenticated root users to manipulate files outside the designated database directory. This flaw allows attackers to exploit directory traversal techniques to create or delete files and directories at arbitrary filesystem locations. Organizations using ArcadeDB should prioritize patching this vulnerability to mitigate the risk of unauthorized file manipulation and potential system compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names containing ../ sequences to create databases at arbitrary filesystem paths or recursively delete directories the server process can access.