CVE-2026-75855 — ArcadeDB before 26.8.1 Path Traversal via create/drop database
ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root use…
Published: 2026-08-18 · CVSS: 8.4 · CVSS 4.0
ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names containing ../ sequences to create databases at arbitrary filesystem paths or recursively delete directories the server process can access.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7