Path Traversal Vulnerability in CloudBeaver by DBeaver

CVE-2026-55449

What is CVE-2026-55449?

CloudBeaver, a cloud database management tool by DBeaver, is susceptible to a path traversal vulnerability prior to version 26.1.2. This issue arises from the application’s resource-management project resolution system, which fails to validate project identifiers properly. An authenticated user possessing resource-management privileges could craft a malicious project identifier that bypasses directory restrictions, enabling the enumeration of filesystem directories beyond the intended shared-projects directory. This leak of filesystem layout information may pose significant risks to the server's integrity, although arbitrary file operations have not been confirmed. The vulnerability has been mitigated in version 26.1.2, which now includes proper validation of project names during path resolution.

References