CVE-2026-75855 in ArcadeDB
Riassunto
di MITRE • 18/08/2026
ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names containing ../ sequences to create databases at arbitrary filesystem paths or recursively delete directories the server process can access.
If you want to get best quality of vulnerability data, you may have to visit VulDB.