CHAT2DB · CVE-2026-124557 · Other
NO FIX YET · SEE WHAT TO DO
Chat2DB, a database client, has a path traversal flaw in its class generator, where the tableName argument is not restricted. A remote attacker can use it to read or write files outside the intended directory on the server running Chat2DB.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running Chat2DB 5.3.8 or earlier with the web server reachable over a network. The CVSS vector from VulDB indicates no privileges needed, but we have not read the vendor's code or advisory to confirm that. The vendor did not respond to the researcher and we found no fixed release; v5.3.8 is the latest stable release, so it is itself in the affected range. Single-user desktop installs with no network exposure are lower risk.
Not affected if local-only-use, version-above-5.3.8
Who cares chat2db, database-tools, self-hosted
5.3.8.unknown: no fixed release found; latest stable v5.3.8 is affected
A vulnerability was detected in OtterMind Chat2DB up to 5.3.8. Impacted is the function DbMybatisGenerateServiceImpl.generateClass of the file DbMybatisGenerateServiceImpl.java of the component Class Generator. The manipulation of the argument tableName results in path traversal. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.