CVE-2026-18274: Heimdall Data Database Proxy uploadJar Directory Traversal Remote Code Execution Vulnerability
Heimdall Data Database Proxy uploadJar Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Heimdall Data Database Proxy. Authentication is required to exploit this vulnerability.
The specific flaw exists within the uploadJar method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-28603.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must be authenticated to the affected Heimdall Data Database Proxy installation. No user interaction is required, and the attack can be performed remotely.
What is the potential impact if exploitation succeeds?
An attacker can use path traversal in the uploadJar method to execute arbitrary code. The code executes in the context of root, resulting in high-impact compromise of confidentiality, integrity, and availability.
How can I determine whether my deployment is exposed?
Assess whether the Heimdall Data Database Proxy instance is affected and whether authenticated users can reach the uploadJar functionality. The supplied information does not identify affected versions or whether the functionality is enabled by default.
What mitigation is available if patching cannot happen immediately?
The provided information does not specify a workaround. As exploitation requires authentication, restricting access to the proxy and limiting access to the uploadJar method to only trusted administrative users can reduce exposure.