CVE-2026-63663
CloudBeaver: Path Traversal in updateResultsDataBatch Allows Unauthorized Server File Stream Access
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
CloudBeaver is a cloud database manager. From version 23.2.3 until 26.1.2, a path traversal vulnerability in its SQL result-editing functionality allows an authenticated user with SQL result-editing privileges to cause the server to open files outside the intended temporary upload directory. In affected database value-handling scenarios, this can disclose local files readable by the CloudBeaver server process. Version 26.1.2 prevents traversal outside the intended temporary upload directory.
| CWE | CWE-22 |
| Vendor | dbeaver |
| Product | cloudbeaver |
| Published | Nov 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for dbeaver cloudbeaver
Be the first to know when new medium vulnerabilities affecting dbeaver cloudbeaver are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
dbeaver / cloudbeaver
>= 23.2.3, < 26.1.2