CVE-2026-103533: Databasement Path Traversal Vulnerability

CVE-2026-103533 Overview

CVE-2026-103533 is a path traversal vulnerability [CWE-22] in the David-Crty databasement application through version 1.7.1. The flaw resides in the app/Http/Requests/Api/V1/RestoreRequest.php file, part of the database-servers API endpoint. Attackers can manipulate the schema_name argument to traverse directories outside the intended scope. The issue is exploitable remotely but requires high privileges and high attack complexity. A public exploit exists, though the vendor describes exploitation as difficult. Upgrading to version 1.7.2 resolves the vulnerability.

Critical Impact
Authenticated remote attackers can abuse the schema_name parameter in the restore request handler to read or interact with files outside the intended directory, affecting confidentiality, integrity, and availability of the database-servers component.

Affected Products

David-Crty databasement versions up to and including 1.7.1
Component: database-servers API endpoint
File: app/Http/Requests/Api/V1/RestoreRequest.php

Discovery Timeline

2026-10-01 - CVE-2026-103533 published to the National Vulnerability Database (NVD)
2026-10-01 - Last updated in NVD database

Technical Details for CVE-2026-103533

Vulnerability Analysis

The vulnerability affects the restore workflow exposed through the database-servers API endpoint in databasement. The RestoreRequest.php request validator accepts a user-supplied schema_name parameter without adequately normalizing or constraining the input to an expected directory. Because the parameter is subsequently incorporated into file-system operations, an authenticated attacker can inject traversal sequences such as ../ to reference resources outside the intended schema directory. The pull request referenced in the advisory, GitHub Pull Request #511, implements the corrective validation.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. Input flowing into the schema_name field is used as part of a file path for restore operations without canonicalization or allow-list validation. Any component that constructs file paths from untrusted request fields must enforce strict normalization and verify the resolved path remains inside the intended base directory.

Attack Vector

Exploitation occurs over the network against the database-servers API endpoint. The attacker must hold high privileges within the application and the attack complexity is high, which raises the operational bar for successful exploitation. A proof-of-concept has been disclosed publicly through the referenced VulDB entry, so defenders should assume the technique is understood by motivated actors even if large-scale exploitation is unlikely.

No verified exploit code is included here. Refer to the GitHub Security Advisory GHSA-x225-463f-pgww for technical details and the fix diff.

Detection Methods for CVE-2026-103533

Indicators of Compromise

Requests to the database-servers restore API containing ../, ..\, URL-encoded %2e%2e%2f, or absolute paths in the schema_name parameter.
Unexpected file reads or access attempts originating from the databasement application service account.
Restore operations targeting schema names that do not match the application's provisioned database list.

Detection Strategies

Inspect application and web-server access logs for POST/PUT requests to the restore endpoint handled by RestoreRequest.php with suspicious schema_name values.
Add a web application firewall (WAF) rule that blocks traversal metacharacters in the schema_name field.
Enable PHP file-access auditing or Linux auditd rules on the directory used for schema storage to flag reads outside the base path.

Monitoring Recommendations

Correlate authenticated API sessions with elevated privileges against anomalous restore activity.
Alert on repeated 4xx/5xx responses from the restore endpoint, which often indicate traversal probing.
Baseline normal schema_name values and alert on deviations, including unusually long strings or non-alphanumeric content.

How to Mitigate CVE-2026-103533

Immediate Actions Required

Upgrade databasement to version 1.7.2 or later as published in the GitHub Release v1.7.2.
Audit accounts with high privileges that can reach the restore endpoint and remove unnecessary access.
Review historical API logs for schema_name values containing traversal sequences and investigate any matches.

Patch Information

The maintainer resolved the issue in release v1.7.2. The code change is tracked in GitHub Pull Request #511 and documented in GitHub Security Advisory GHSA-x225-463f-pgww. Administrators should apply the upgrade in all environments, including staging and development, where the component is deployed.

Workarounds

If upgrading immediately is not possible, restrict network access to the database-servers API endpoint to trusted administrative networks only.
Deploy a WAF or reverse-proxy rule rejecting any schema_name value that contains .., /, \, or URL-encoded equivalents.
Reduce the number of accounts granted the high-privilege role required to invoke the restore operation until the patch is applied.

bash

# Example reverse-proxy rule (NGINX) to block traversal in schema_name
if ($arg_schema_name ~* "(\.\.|%2e%2e|/|\\)") {
    return 403;
}