CVE-2026-63663: medium-severity vulnerability in dbeaver cloudbeaver
CloudBeaver: Path Traversal in updateResultsDataBatch Allows Unauthorized Server File Stream Access
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
10Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5
CloudBeaver is a cloud database manager. From version 23.2.3 until 26.1.2, a path traversal vulnerability in its SQL result-editing functionality allows an authenticated user with SQL result-editing privileges to cause the server to open files outside the intended temporary upload directory. In affected database value-handling scenarios, this can disclose local files readable by the CloudBeaver server process. Version 26.1.2 prevents traversal outside the intended temporary upload directory.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
dbeaver · cloudbeaverRelated CVEs — dbeaver cloudbeaver
In the same product, most dangerous first.