MEDIUM 6.5 NVD
CVE-2026-63663
CloudBeaver is a cloud database manager. From version 23.2.3 until 26.1.2, a path traversal vulnerability in its SQL result-editing functionality allows an auth
CloudBeaver is a cloud database manager. From version 23.2.3 until 26.1.2, a path traversal vulnerability in its SQL result-editing functionality allows an authenticated user with SQL result-editing privileges to cause the server to open files outside the intended temporary upload directory. In affected database value-handling scenarios, this can disclose local files readable by the CloudBeaver server process. Version 26.1.2 prevents traversal outside the intended temporary upload directory.
References
- https://github.com/dbeaver/cloudbeaver/commit/caef729a8d227b0446eab6f0ae5f1dc20dced9b5
- https://github.com/dbeaver/cloudbeaver/pull/4411
- https://github.com/dbeaver/cloudbeaver/security/advisories/GHSA-8wr4-mh28-m992
This medium severity vulnerability with a CVSS score of 6.5 was published on 2026-11-06 via NVD.
vulnfeed aggregates 16326 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.