CVE-2026-75855: ArcadeDB before 26.8.1 Path Traversal via create/drop database

Published Aug 18, 2026
·
Updated

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names containing ../ sequences to create databases at arbitrary filesystem paths or recursively delete directories the server process can access.

Affected Software

1 affected component
ArcadeDB ArcadeDB<26.8.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade ArcadeDB to a version that resolves this vulnerability.

    Fixed in 26.8.1
  2. Compensating control

    Until upgrading, restrict access to ArcadeDB so only trusted admin/root users can reach POST /api/v1/server endpoints (create database and drop database), e.g., via network ACL/firewall and/or authentication/authorization controls.

  3. Operational

    After upgrading to 26.8.1, review the ArcadeDB configured database directory for unexpected files/directories that may have been created or deleted via path traversal.

Event History

Aug 18, 2026
CVE Published
via MITRE·11:19 AM
Data Sourced
via MITRE·11:19 AM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Who is realistically exposed to this vulnerability?

Instances running a version before 26.8.1 are affected if an attacker can authenticate as a root user and reach the POST /api/v1/server endpoint. The issue is exposed through the create database and drop database commands.

2

What access does an attacker need to exploit it?

An attacker needs root-level authentication; no user interaction is required. They can provide a database name containing ../ sequences to escape the configured database directory.

3

What can an attacker do after exploiting the issue?

Successful exploitation can create database files at arbitrary filesystem paths or recursively delete directories accessible to the ArcadeDB server process. The impact is therefore constrained by the operating-system permissions of that process.

4

What should be done if patching cannot happen immediately?

Upgrade ArcadeDB to version 26.8.1 or later. If upgrading is not immediately possible, restrict root access and limit network access to the server API, especially the POST /api/v1/server endpoint.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203