CVE-2026-75855: ArcadeDB Path Traversal Vulnerability

CVE-2026-75855 Overview

ArcadeDB versions before 26.8.1 fail to sanitize database names supplied to the POST /api/v1/server endpoint. The create database and drop database commands accept attacker-controlled names without validation, enabling directory traversal outside the configured database directory. Authenticated root users can write files to arbitrary filesystem paths or recursively delete directories accessible to the server process. The flaw is tracked as a path traversal weakness under CWE-22.

Critical Impact
Authenticated root users can create files at arbitrary filesystem locations or recursively delete directories, leading to integrity loss, denial of service, and potential code execution on the host running ArcadeDB.

Affected Products

ArcadeDB versions prior to 26.8.1
ArcadeDB server component exposing POST /api/v1/server
Deployments where the root account is reachable over the network

Discovery Timeline

2026-08-18 - CVE-2026-75855 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-75855

Vulnerability Analysis

The vulnerability resides in the server management API handler for POST /api/v1/server. The create database and drop database commands take a database name string and use it directly to compute filesystem paths under the configured database directory. Because the handler does not reject ../ sequences or absolute paths, an attacker can traverse outside the intended directory root.

On a create operation, the server writes new database files at the resolved path. On a drop operation, the server recursively removes the resolved directory. Both primitives execute with the privileges of the ArcadeDB process, granting write and delete access to any location the process can reach.

Exploitation requires the attacker to authenticate as root, which limits the vulnerability to environments where credentials are exposed, reused, or weakly protected. Once authenticated, exploitation is a single HTTP request and does not require user interaction.

Root Cause

The root cause is missing input sanitization on the database name parameter. ArcadeDB concatenates the user-supplied name into a filesystem path without normalizing or validating it against the configured base directory. This is a canonical instance of CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

An authenticated attacker sends a crafted JSON payload to POST /api/v1/server containing a create database or drop database command with a database name such as ../../etc/arcade_evil. The server resolves the path outside the database directory and performs the corresponding write or recursive delete. Refer to the ArcadeDB GitHub Security Advisory GHSA-qwgr-2c45-63xx and the VulnCheck Advisory on ArcadeDB for technical details.

Detection Methods for CVE-2026-75855

Indicators of Compromise

HTTP POST requests to /api/v1/server containing ../ or absolute paths inside the database name field.
Unexpected directories or files appearing outside the configured ArcadeDB data directory owned by the ArcadeDB service account.
Missing files or directories on the host after drop database API calls.
Authentication events for the ArcadeDB root account from unexpected source IPs.

Detection Strategies

Inspect ArcadeDB access logs for create database and drop database commands with names containing .., /, or \ characters.
Deploy web application firewall rules that block traversal sequences in JSON bodies sent to /api/v1/server.
Correlate ArcadeDB API activity with filesystem change events on the host to identify writes or deletes outside the database directory.

Monitoring Recommendations

Enable filesystem integrity monitoring on directories adjacent to the ArcadeDB data root.
Alert on any use of the root account against the /api/v1/server endpoint from non-administrative source addresses.
Forward ArcadeDB logs and host telemetry to a centralized analytics platform such as Singularity Data Lake for retention and query.

How to Mitigate CVE-2026-75855

Immediate Actions Required

Upgrade ArcadeDB to version 26.8.1 or later on all servers.
Rotate the ArcadeDB root credential and any service accounts with server management privileges.
Restrict network exposure of /api/v1/server to trusted administrative networks only.
Audit the ArcadeDB host filesystem for unauthorized files or missing directories.

Patch Information

The issue is fixed in ArcadeDB 26.8.1. The patched release validates database names and rejects path traversal sequences before performing create or drop operations. Consult the ArcadeDB GitHub Security Advisory for the full remediation notes and the fixed commit.

Workarounds

Block external access to the POST /api/v1/server endpoint via reverse proxy or firewall rules until patching is complete.
Enforce strong, unique credentials for the root account and disable it where not required for automation.
Run the ArcadeDB process under a least-privilege user account with filesystem access limited to the intended database directory.

bash

# Example reverse proxy rule blocking traversal payloads to the server endpoint
location /api/v1/server {
    if ($request_body ~* "\.\./") { return 403; }
    proxy_pass http://arcadedb_backend;
}