Read the docs
TI-2026-86105 Aliases CVE-2026-63663

Path traversal in CloudBeaver lets users read server files

Priority LOW 29CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

CloudBeaver from version 23.2.3 before 26.1.2 contains a path traversal flaw (CWE-22) in its SQL result-editing functionality. An authenticated user with SQL result-editing privileges can make the server open files outside the intended temporary upload directory. In affected database value-handling scenarios, this discloses local files readable by the CloudBeaver server process.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

CloudBeaver is a cloud database manager. From version 23.2.3 until 26.1.2, a path traversal vulnerability in its SQL result-editing functionality allows an authenticated user with SQL result-editing privileges to cause the server to open files outside the intended temporary upload directory. In affected database value-handling scenarios, this can disclose local files readable by the CloudBeaver server process. Version 26.1.2 prevents traversal outside the intended temporary upload directory.

Why it matters now

EPSS 0.00316 24th percentileScored 2026-11-07
Fix Fixed cloudbeaver (dbeaver): 26.1.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
dbeavercloudbeaver23.2.3 to before 26.1.226.1.2Patch availableCNA
  • cloudbeaver Vendordbeaver Affected 23.2.3 to before 26.1.2 Fixed in 26.1.2 Patch available CNA

Remediation

Upgrade CloudBeaver to version 26.1.2, which prevents traversal outside the intended temporary upload directory.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA cloudbeaver (dbeaver) Fixed in 26.1.2

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-63663
  2. 2026-11-08 Priority changed: MEDIUM → LOW

References

Other 3

  • TI-2026-70721 Missing authorization in DBeaver CloudBeaver initConnection mutation CVSS 4.0MEDIUM 5.3
  • TI-2026-86106 Authorization bypass in CloudBeaver lets users export restricted data CVSS 3.1MEDIUM 6.5
  • TI-2021-02767 Improper Restriction of XML External Entity Reference in dbeaver/dbeaver CVSS 3.1MEDIUM 5.5
  • TI-2026-86103 Path traversal in CloudBeaver Resource Manager exposes directory names CVSS 4.0MEDIUM 5.3
  • TI-2026-70723 CloudBeaver missing authorization exposes other users' LOB exports CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences