CVE-2026-55449— CloudBeaver: Path Traversal in Resource Manager getProjectPath allows directory enumeration outside shared-projects sandbox

Quick assessment

Affected

dbeaver cloudbeaver

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

CloudBeaver 是一款云数据库管理工具。在 26.1.2 版本之前，其资源管理模块在解析项目时，接受项目标识符而未验证其是否为安全的路径组件。拥有资源管理权限的已认证用户可以提供经过篡改的项目标识符，导致路径解析跳出共享项目目录，从而枚举服务器其他位置的目录名称。此漏洞可能泄露文件系统的布局信息。目前尚未确认是否存在任意文件读取、写入或删除的风险。该问题已在 26.1.2 版本中修复，修复方法是在解析共享项目路径之前对项目名称进行验证。

CVSS 5.3 · Medium Updated Nov 07, 2026

Possible ATT&CK Techniques 2 AI

T1083 · File and Directory Discovery T1083.002

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

CloudBeaver: Path Traversal in Resource Manager getProjectPath allows directory enumeration outside shared-projects sandbox

Source: CVE Program / CVE List V5

Vulnerability Description

CloudBeaver is a cloud database manager. Prior to 26.1.2, its resource-management project resolution accepts project identifiers without validating that they are safe path components. An authenticated user with resource-management privileges can supply a crafted project identifier that causes path resolution to escape the shared-projects directory and enumerate directory names elsewhere on the server. This can disclose filesystem layout information. Arbitrary file reads, writes, and deletion are not confirmed. The issue is fixed in 26.1.2 by validating project names before resolving the shared-project path.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
dbeaver	cloudbeaver	< 26.1.0	-

II. Public POCs for CVE-2026-55449

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-55449

请登录查看更多情报信息。

Other References for CVE-2026-55449 (3)

https://github.com/dbeaver/cloudbeaver/pull/4367 x_refsource_MISC
https://github.com/dbeaver/cloudbeaver/security/advisories/GHSA-6x6p-mrpr-wfq9 x_refsource_CONFIRM
https://github.com/dbeaver/cloudbeaver/commit/a333e5841a18b38c82d3769a55974700108cedbe x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-55449

Same Patch Batch · dbeaver · 2026-11-06 · 3 CVEs total

CVE-2026-63663	6.5 MEDIUM	CloudBeaver: Path Traversal in updateResultsDataBatch Allows Unauthorized Server File Stre
CVE-2026-63664	6.5 MEDIUM	CloudBeaver: Authorization Bypass (BFLA) - Data Export Restriction Bypass

IV. Related Vulnerabilities

Same product: cloudbeaver

Same vendor: dbeaver

Same weakness: CWE-22