CVE-2026-85964 in MarkLogic Server
Summary
by MITRE • 10/12/2026
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow an authenticated Query Console user to supply unsafe path values to a privileged filesystem helper, which could result in disclosure of arbitrary server files.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in Progress MarkLogic Server versions prior to 12.1.0 and 11.x releases before 11.3.7 represents a critical security flaw within the Query Console interface. This component serves as an administrative tool allowing users to execute queries against the database, but it also includes privileged filesystem helper functions intended for internal system operations or authorized administrative tasks. The core technical issue stems from insufficient validation of path inputs provided by authenticated users interacting with these helpers. Specifically, when a user supplies unsafe path values, such as those containing directory traversal sequences like dot-dot-slash (..), the server fails to properly sanitize or restrict access boundaries. This lack of input sanitization allows an attacker who has obtained valid credentials for Query Console to manipulate file system operations beyond their intended scope.
From a technical perspective, this flaw is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or directory traversal. The vulnerability exploits the way the application processes relative paths without adequate normalization checks against the allowed root directories. By injecting maliciously crafted path strings into API endpoints exposed by Query Console, an authenticated actor can bypass access controls that are supposed to restrict file system interactions to specific, safe locations. This enables the reading of arbitrary files from the server's operating system, including configuration files, database dumps, or other sensitive data stored on disk that should not be accessible via standard query operations.
The operational impact of this vulnerability is severe for organizations relying on MarkLogic Server for critical data management and application backends. An attacker with low-privileged Query Console access can escalate their influence by exfiltrating confidential information such as database credentials, encryption keys, or proprietary business logic stored in configuration files. This disclosure compromises the confidentiality integrity of the entire system environment. Furthermore, if combined with other vulnerabilities or misconfigurations, this file read capability could potentially lead to remote code execution or further lateral movement within the network infrastructure. The ability to access arbitrary server files undermines the security model that relies on authentication boundaries to protect sensitive resources.
To mitigate this risk, organizations must immediately upgrade their MarkLogic Server instances to version 12.1.0 or later for the 12.x branch, or version 11.3.7 and above for the 11.x branch, where these path validation mechanisms have been corrected. In addition to patching, administrators should enforce strict least-privilege principles by limiting Query Console access only to users who genuinely require it for administrative purposes. Network segmentation can also help isolate MarkLogic servers from untrusted networks, reducing the attack surface available to potential intruders. Security monitoring tools should be configured to detect unusual file system access patterns or repeated failed authentication attempts associated with path traversal payloads in query logs.
This vulnerability aligns with MITRE ATT&CK technique T1083: File and Directory Discovery, where adversaries search for sensitive information on compromised systems. It also relates to T1530: Data from Local System, as the exploitation involves reading files directly from the host operating system rather than just querying the database content. Understanding these mappings helps security teams contextualize the threat within broader attack frameworks and prioritize remediation efforts based on potential adversary behaviors. Regular audits of administrative interfaces and continuous validation of input handling in privileged functions are essential practices to prevent similar path traversal vulnerabilities in enterprise software environments.