CVE-2026-75855
HIGH
NVD
CVSS Score
8.7
Severity
HIGH
Published
Aug 18, 2026
Vendor
unknown
Description
ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names containing ../ sequences to create databases at arbitrary filesystem paths or recursively delete directories the server process can access.