Skip to content
OpenAdvisories
High · 8.7 Public exploit CVE-2026-75855 EUVD-2026-60616GHSA-vvcg-f4wp-c6qr

ArcadeDB before 26.8.1 Path Traversal via create/drop database

Published Aug 18, 2026 · Updated Aug 19, 2026 · Assigned by VulnCheck

Vendor: ArcadeData Product: arcadedb

Description

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names containing ../ sequences to create databases at arbitrary filesystem paths or recursively delete directories the server process can access.

Affected products

VendorProductAffectedFixed
ArcadeData arcadedb < 26.8.1 26.8.1

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • pervinzahidli/CVE-2026-75855 ★ 0 · Sep 1, 2026

    ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References