CVE-2026-75855 in ArcadeDB
Summary
by MITRE • 08/18/2026
ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names containing ../ sequences to create databases at arbitrary filesystem paths or recursively delete directories the server process can access.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified in ArcadeDB versions prior to 26.8.1 represents a critical path traversal and improper input validation flaw within the HTTP API interface, specifically targeting the POST /api/v1/server endpoint used for database management operations. This security defect allows an authenticated root user to manipulate filesystem paths through unsanitized inputs provided during create or drop database commands. The core technical failure lies in the application's handling of the database name parameter, which is intended to be a logical identifier but is directly concatenated into file system operation calls without adequate validation against directory traversal sequences such as ../. This lack of sanitization enables an attacker to break out of the designated data storage directory and interact with arbitrary locations on the host operating system where the ArcadeDB server process has permissions.
From a technical perspective, this vulnerability exploits the fundamental principle that user-supplied input must never be trusted for structural decisions like file paths without rigorous validation. When a root-level authenticated user submits a database name containing relative path traversal sequences, the underlying Java File operations interpret these sequences as instructions to move up directory levels. Consequently, instead of creating or deleting a subdirectory within the configured data folder, the server executes commands that affect files and directories at arbitrary absolute paths. This behavior effectively grants an attacker with root API access equivalent capabilities to those of the operating system user running the ArcadeDB process, leading to potential remote code execution if combined with other vulnerabilities, or significant denial of service through recursive deletion of critical system directories.
The operational impact of this flaw is severe due to the privilege level required for exploitation and the breadth of filesystem access granted by root privileges on many Linux distributions. An attacker who has obtained valid credentials for a root account in ArcadeDB can overwrite configuration files, inject malicious scripts into executable paths if they control those locations, or permanently destroy data integrity by deleting essential database files outside the sandboxed environment. Furthermore, because the drop command allows recursive deletion of directories, an adversary could potentially erase large portions of the file system, causing widespread service disruption and requiring extensive recovery efforts from backups that may also be compromised depending on their storage location relative to the traversal path.
This vulnerability aligns with CWE-22 Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) as it involves accessing files outside intended directories through manipulated input paths. Additionally, it relates to CWE-78 OS Command Injection if the underlying implementation constructs shell commands rather than using safe API calls for file operations, although the primary classification remains path traversal due to the direct manipulation of filesystem structure via application logic. In terms of MITRE ATT&CK mapping, this behavior corresponds to T1046 Network Service Discovery or more accurately T1530 Data from Information Repositories if used for exfiltration, but most critically it facilitates privilege escalation and lateral movement by allowing modification of system files that could be leveraged in subsequent attacks. The scenario also touches upon T1489 Service Stop as the recursive deletion capability can effectively halt services by removing critical dependencies or data stores.
Mitigation strategies must prioritize immediate patching to version 26.8.1 or later, where this input validation issue has been addressed. In environments where upgrading is not immediately feasible, network-level controls should be implemented to restrict access to the /api/v1/server endpoint exclusively to trusted internal networks and enforce strict authentication policies with multi-factor authentication for root accounts. Application-layer firewalls can also help by inspecting HTTP POST payloads for common path traversal patterns such as ../ or ..\ before they reach the application logic, although this is a compensatory control rather than a fix. Developers should implement allow-list validation for database names to ensure only alphanumeric characters and safe delimiters are accepted, thereby eliminating the possibility of injecting directory navigation sequences into file system operations regardless of user privilege level.