CVE-2026-75855: ArcadeDB before 26.8.1 Path Traversal via create/drop database
ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names containing ../ sequences to create databases at arbitrary filesystem paths or recursively delete directories the server process can access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ArcadeDBto a version that resolves this vulnerability.Fixed in 26.8.1 - Compensating control
Until upgrading, restrict access to ArcadeDB so only trusted admin/root users can reach POST /api/v1/server endpoints (create database and drop database), e.g., via network ACL/firewall and/or authentication/authorization controls.
- Operational
After upgrading to 26.8.1, review the ArcadeDB configured database directory for unexpected files/directories that may have been created or deleted via path traversal.
Event History
Frequently Asked Questions
Who is realistically exposed to this vulnerability?
Instances running a version before 26.8.1 are affected if an attacker can authenticate as a root user and reach the POST /api/v1/server endpoint. The issue is exposed through the create database and drop database commands.
What access does an attacker need to exploit it?
An attacker needs root-level authentication; no user interaction is required. They can provide a database name containing ../ sequences to escape the configured database directory.
What can an attacker do after exploiting the issue?
Successful exploitation can create database files at arbitrary filesystem paths or recursively delete directories accessible to the ArcadeDB server process. The impact is therefore constrained by the operating-system permissions of that process.
What should be done if patching cannot happen immediately?
Upgrade ArcadeDB to version 26.8.1 or later. If upgrading is not immediately possible, restrict root access and limit network access to the server API, especially the POST /api/v1/server endpoint.