Executive brief
ArcadeDB is a database server that manages multiple database instances on disk. When an authenticated root user creates or deletes a database, the server fails to validate the database name, allowing an attacker to use path traversal sequences (like "../") to write database files or delete directories anywhere on the filesystem that the server process can access. This bypasses the intended database directory containment, potentially exposing or destroying critical system files.
Technical details
The vulnerability is a path traversal flaw (CWE-22) in the POST /api/v1/server endpoint's create database and drop database commands. The server accepts a user-supplied database name and directly concatenates it into a filesystem path via String concatenation without sanitization, normalization (Path.normalize()), or containment validation. An authenticated root user can inject "../" sequences in the database name to escape the configured databaseDirectory and create or recursively delete arbitrary files and directories anywhere the JVM process has OS permissions. The root cause is the lack of any path validation in the createDatabase() and dropDatabase() methods, as well as DatabaseFactory, which never verifies the resolved path remains under the intended base directory. Exploitation requires valid ArcadeDB root credentials; the fix is available in version 26.8.1 and later.
Affected products
- ArcadeData ArcadeDB < 26.8.1
Timeline
- 2026-08-04: disclosed: GHSA published
- 2026-08-18: advisory: CVE-2026-75855 and NVD entry published
- 2026-08-18: patched: Fixed in version 26.8.1