ZDI-CAN-28603: ZDI-26-479: Heimdall Data Database Proxy uploadJar Directory Traversal Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Heimdall Data Database Proxy. Authentication is required to exploit this vulnerability. The specific flaw exists within the uploadJar method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of root.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Heimdall Data Database Proxy. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-18274.
— ZDI
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker who can authenticate to an affected Heimdall Data Database Proxy installation can exploit it. The supplied data does not identify which authenticated roles or permission levels have access to the vulnerable uploadJar method.
What access and conditions does exploitation require?
Exploitation requires network access and valid authentication; no user interaction is required. The attacker must be able to supply a path to the uploadJar method, where insufficient path validation can lead to file operations outside the intended location.
What is the impact if exploitation succeeds?
An attacker can execute arbitrary code in the context of root. This can result in complete compromise of confidentiality, integrity, and availability on the affected system.
How can I determine whether an installation is affected?
The provided information identifies Heimdall Data Database Proxy as affected and identifies the vulnerable component as uploadJar. It does not provide affected or fixed version numbers, so version-based determination is not possible from this data alone.