{"affected":[{"product":"cloudbeaver","source":"CNA: GitHub_M","vendor":"dbeaver","versions":[{"status":"affected","version":">= 23.2.3, < 26.1.2"}]}],"cveId":"CVE-2026-63663","cwes":["CWE-22"],"description":"CloudBeaver is a cloud database manager. From version 23.2.3 until 26.1.2, a path traversal vulnerability in its SQL result-editing functionality allows an authenticated user with SQL result-editing privileges to cause the server to open files outside the intended temporary upload directory. In affected database value-handling scenarios, this can disclose local files readable by the CloudBeaver server process. Version 26.1.2 prevents traversal outside the intended temporary upload directory.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.5,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1793995661007,"publishedAt":1793995661007,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/dbeaver/cloudbeaver/security/advisories/GHSA-8wr4-mh28-m992"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/dbeaver/cloudbeaver/pull/4411"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/dbeaver/cloudbeaver/commit/caef729a8d227b0446eab6f0ae5f1dc20dced9b5"}],"remediation":[],"revision":"b60e8fc9a855ff45add270f43d2e01b401650eac9f6f810fbc7ba0bff22539b2","sources":[{"modifiedAt":1793995661007,"name":"CNA: GitHub_M","retrievedAt":1793999375830,"url":"https://www.cve.org/CVERecord?id=CVE-2026-63663"}],"ssvc":null,"status":"published","title":"CloudBeaver: Path Traversal in updateResultsDataBatch Allows Unauthorized Server File Stream Access","updatedAt":1793999375830}