CloudBeaver: Path Traversal in Resource Manager getProjectPath allows directory enumeration outside shared-projects sandbox

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

CloudBeaver is a cloud database manager. Prior to 26.1.2, its resource-management project resolution accepts project identifiers without validating that they are safe path components. An authenticated user with resource-management privileges can supply a crafted project identifier that causes path resolution to escape the shared-projects directory and enumerate directory names elsewhere on the server. This can disclose filesystem layout information. Arbitrary file reads, writes, and deletion are not confirmed. The issue is fixed in 26.1.2 by validating project names before resolving the shared-project path.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…beaver/security/advisories/GHSA-6x6p-mrpr-wfq9 Diğer
• github.com/dbeaver/cloudbeaver/pull/4367 Diğer
• github.com/…ommit/a333e5841a18b38c82d3769a55974700108cedbe Diğer

Kayıt geçmişi

1. 6 Kas 2026 23:04Yayımlandı

İlgili açıklar

• 6,5 CVE-2026-63663CloudBeaver: Path Traversal in updateResultsDataBatch Allows Unauthorized Server File Stream Access
• 6,5 CVE-2026-63664CloudBeaver: Authorization Bypass (BFLA) - Data Export Restriction Bypass
• 5,7 CVE-2026-124029Kopia through 0.23.1 Path Traversal in Snapshot Restore via Directory Entry Names
• 6,5 CVE-2026-108262DDEV incomplete tar symlink traversal fix allows host file overwrite - Incomplete fix of CVE-2026-32885
• 6,3 CVE-2026-75598Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitization
• 6,5 CVE-2026-119758ERPNext OCR 1.1.1 Path Traversal and SSRF via read_document