Description

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names containing ../ sequences to create databases at arbitrary filesystem paths or recursively delete directories the server process can access.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-08-18T12:19:35.997Z",
  "pubdate": "2026-08-18T12:19:35.997Z",
  "executiveSummary": "ArcadeDB versions prior to 26.8.1 suffer from a critical path traversal vulnerability within the database creation and deletion functionalities. The flaw exists due to inadequate input sanitization of database names supplied via the POST /api/v1/server endpoint, specifically within commands designed to create or drop databases. This deficiency permits authenticated root users to supply malicious payloads containing directory traversal sequences, such as ../, enabling them to manipulate the underlying filesystem well outside the boundaries of the configured database directory. The primary impact of this vulnerability includes arbitrary file creation and recursive directory deletion across any location accessible to the operating system process running the server. While exploitation requires authentication with root privileges, successful execution grants attackers significant control over the host filesystem, potentially leading to critical data loss, integrity compromise, or system instability. The attack vector is exposed via network protocols interfacing with the server API, making strict input validation and access control enforcement essential remediation requirements.",
  "technicalDetails": "The vulnerability resides in the server-side logic handling database management commands exposed through the POST /api/v1/server endpoint in ArcadeDB. Specifically, the routines responsible for executing create database and drop database commands fail to properly validate and sanitize the database name parameter provided by the client. Consequently, input strings containing path traversal sequences like ../ are accepted and processed directly by file I/O operations within the application.\nThe root cause is a lack of canonicalization and validation checks on the database identifier before it is concatenated with base directory paths to construct filesystem paths. When an authenticated root user submits a crafted payload containing relative path specifiers in the database name field, the application resolves these paths relative to the intended storage directory, allowing execution outside the intended scope. For database creation commands, this permits the application to instantiate database structures and write files to arbitrary filesystem paths writable by the server process user. For database deletion commands, the recursive drop logic traverses the specified path and deletes directories outside the designated database repository.\nThe attack flow proceeds as follows: First, an attacker establishes network connectivity to the ArcadeDB server API. Second, the attacker authenticates using root-level credentials to meet the prerequisite privilege requirements. Third, the attacker issues an HTTP POST request to the /api/v1/server endpoint containing a specially crafted JSON payload or command string where the database name parameter includes directory traversal sequences (e.g., ../../../sensitive/path/dir). Fourth, the vulnerable component parses the input without sanitizing the path sequences, resolving the target path outside the configured database directory. Finally, the application executes the file creation or recursive deletion routine against the unintended target path, resulting in arbitrary file writing or the destruction of accessible system directories.\nThe affected component is the database management API handling server-level commands in ArcadeDB versions before 26.8.1. Exploitation requires network access to the API endpoint, valid authentication credentials, and root-level privileges within the application. The post-exploitation impact includes unauthorized file creation, modification, or complete recursive destruction of critical directories and files accessible to the security context of the running server process."
}