{"id":"CVE-2026-75855","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-75855","summary":"ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to…","details":"ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names containing ../ sequences to create databases at arbitrary filesystem paths or recursively delete directories the server process can access.","published":"2026-08-18T12:19:35.997","modified":"2026-08-18T12:19:35.997","cvss":{"score":8.7,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-qwgr-2c45-63xx"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/arcadedb-before-path-traversal-via-create-drop-database"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-08-18T12:19:35.997"}}