Path Traversal Vulnerability in OtterMind Chat2DB Affecting Version 5.3.8

CVE-2026-124557

What is CVE-2026-124557?

A vulnerability in OtterMind's Chat2DB product, specifically within the DbMybatisGenerateServiceImpl class, allows attackers to manipulate the 'tableName' argument, leading to potential path traversal attacks. This may enable malicious actors to gain unauthorized access to filesystem data. The exploit can be executed remotely, posing significant security risks if left unaddressed. Despite early disclosure attempts to the vendor, no response was received, making the public exploit particularly concerning for users of affected versions.

References