| Title | David-Crty Databasement >= 1.2.0, < 1.7.2 Path Traversal |
|---|
| Description | A path traversal vulnerability was identified in the SQLite restore functionality of Databasement, an open-source Laravel-based database backup management platform. The schema_name parameter in the restore API endpoint (POST /api/v1/database-servers/{id}/restore) accepts arbitrary file paths without validation. When restoring a SQLite snapshot, the application uses PHP's copy() function to write the snapshot file to the path specified by schema_name. An authenticated user with Member, Admin, or Demo role can supply a traversal path (e.g., /app/public/shell.php) to write a malicious SQLite file — containing embedded PHP code in a text column — to the web root, achieving remote code execution as the application user. The vulnerability exists because the SQLite database type validation rules only enforce 'required', 'string', 'max:255' without any path restriction, while other database types (MySQL, PostgreSQL) enforce a strict alphanumeric regex. The application has a SafePath validation rule used elsewhere but it was not applied to the SQLite restore schema_name parameter. The vulnerability is present in both the API (DatabaseServerController) and Livewire (Restore Modal) restore flows. Patched in version 1.7.2 by adding path validation to reject absolute paths and directory traversal sequences. |
|---|
| Source | ⚠️ https://github.com/David-Crty/databasement/security/advisories/GHSA-x225-463f-pgww |
|---|
| User | ByteJMP (UID 99294) |
|---|
| Submission | 09/03/2026 04:39 (28 days ago) |
|---|
| Moderation | 09/30/2026 21:07 (28 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 412345 [David-Crty databasement up to 1.7.1 database-servers API Endpoint RestoreRequest.php schema_name path traversal] |
|---|
| Points | 20 |
|---|