# CVE-2026-75855: ArcadeDB path traversal in create/drop database commands

Source: https://junglewise.ai/threats/cve-2026-75855-arcadedb-path-traversal-in-create-drop-database-commands  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75855 · Severity: high · CVSS 8.7 · Published 2026-08-18

ArcadeDB is a database server that manages multiple database instances on disk. When an authenticated root user creates or deletes a database, the server fails to validate the database name, allowing an attacker to use path traversal sequences (like "../") to write database files or delete directories anywhere on the filesystem that the server process can access. This bypasses the intended database directory containment, potentially exposing or destroying critical system files.

Technologies: [ArcadeData ArcadeDB](https://junglewise.ai/threats/technologies/arcadedb). Vendors: [ArcadeData](https://junglewise.ai/threats/vendors/arcadedata).

## Quick answers

**Is CVE-2026-75855 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75855 being exploited in the wild.

**How severe is CVE-2026-75855?** High severity, with a CVSS score of 8.7, published 18 August 2026.

**Which products and versions are affected?** ArcadeData ArcadeDB < 26.8.1.

**Is there a fix for CVE-2026-75855?** A patch was published on 2026-08-18: Fixed in version 26.8.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75855 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-75855?** Check whether you run ArcadeData ArcadeDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a path traversal flaw (CWE-22) in the POST /api/v1/server endpoint's create database and drop database commands. The server accepts a user-supplied database name and directly concatenates it into a filesystem path via String concatenation without sanitization, normalization (Path.normalize()), or containment validation. An authenticated root user can inject "../" sequences in the database name to escape the configured databaseDirectory and create or recursively delete arbitrary files and directories anywhere the JVM process has OS permissions. The root cause is the lack of any path validation in the createDatabase() and dropDatabase() methods, as well as DatabaseFactory, which never verifies the resolved path remains under the intended base directory. Exploitation requires valid ArcadeDB root credentials; the fix is available in version 26.8.1 and later.

## Affected products

- ArcadeData ArcadeDB < 26.8.1

## Timeline

- 2026-08-04: disclosed: GHSA published
- 2026-08-18: advisory: CVE-2026-75855 and NVD entry published
- 2026-08-18: patched: Fixed in version 26.8.1

## References

- [https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-qwgr-2c45-63xx](https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-qwgr-2c45-63xx)
- [https://www.vulncheck.com/advisories/arcadedb-before-path-traversal-via-create-drop-database](https://www.vulncheck.com/advisories/arcadedb-before-path-traversal-via-create-drop-database)

## Related threats

- [ArcadeDB improper authorization in wire-protocol connections](https://junglewise.ai/threats/cve-2026-119577-arcadedb-before-26-10-2-contains-an-improper-authorization)
- [ArcadeDB authorization bypass in GraphQL schema endpoint](https://junglewise.ai/threats/cve-2026-119576-arcadedb-from-21-12-1-before-26-10-2-contains-an-authorization)
- [ArcadeDB server-side request forgery in LOAD CSV](https://junglewise.ai/threats/cve-2026-119575-arcadedb-from-26-8-1-before-26-10-2-contains-a-server-side)
- [ArcadeDB remote code execution in Gremlin Groovy engine](https://junglewise.ai/threats/cve-2026-114059-arcadedb-before-26-10-1-contains-a-remote-code-execution)
- [ArcadeDB Bolt protocol missing authorization](https://junglewise.ai/threats/cve-2026-114058-arcadedb-from-26-2-1-before-26-10-1-contains-a-missing)