Read the docs
TI-2026-86103 Aliases CVE-2026-55449

Path traversal in CloudBeaver Resource Manager exposes directory names

Priority LOW 24CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

CloudBeaver, a cloud database manager, is affected before 26.1.2. Its Resource Manager project resolution accepts project identifiers without validating that they are safe path components, a path traversal flaw (CWE-22). An authenticated user with resource-management privileges can make path resolution escape the shared-projects directory and list directory names elsewhere on the server. Arbitrary file reads, writes or deletion are not confirmed.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

CloudBeaver is a cloud database manager. Prior to 26.1.2, its resource-management project resolution accepts project identifiers without validating that they are safe path components. An authenticated user with resource-management privileges can supply a crafted project identifier that causes path resolution to escape the shared-projects directory and enumerate directory names elsewhere on the server. This can disclose filesystem layout information. Arbitrary file reads, writes, and deletion are not confirmed. The issue is fixed in 26.1.2 by validating project names before resolving the shared-project path.

Why it matters now

EPSS 0.00313 24th percentileScored 2026-11-07
Fix Fixed cloudbeaver (dbeaver): 26.1.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
dbeavercloudbeaverbefore 26.1.026.1.0Patch availableCNA
  • cloudbeaver Vendordbeaver Affected before 26.1.0 Fixed in 26.1.0 Patch available CNA

Remediation

Upgrade CloudBeaver to version 26.1.2, which validates project names before resolving the shared-project path. The affected data lists 26.1.0 as the fixed version, which conflicts with the description's 26.1.2.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA cloudbeaver (dbeaver) Fixed in 26.1.0

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-55449

References

Other 3

  • TI-2026-70721 Missing authorization in DBeaver CloudBeaver initConnection mutation CVSS 4.0MEDIUM 5.3
  • TI-2026-86105 Path traversal in CloudBeaver lets users read server files CVSS 3.1MEDIUM 6.5
  • TI-2026-86106 Authorization bypass in CloudBeaver lets users export restricted data CVSS 3.1MEDIUM 6.5
  • TI-2021-02767 Improper Restriction of XML External Entity Reference in dbeaver/dbeaver CVSS 3.1MEDIUM 5.5
  • TI-2026-70723 CloudBeaver missing authorization exposes other users' LOB exports CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences