{"id":"CVE-2026-124557","kind":"vulnerability","aliases":["CVE-2026-124557"],"related":[],"title":"Chat2DB: path traversal in code generator lets remote users write files","description":"A vulnerability was detected in OtterMind Chat2DB up to 5.3.8. Impacted is the function DbMybatisGenerateServiceImpl.generateClass of the file DbMybatisGenerateServiceImpl.java of the component Class Generator. The manipulation of the argument tableName results in path traversal. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Chat2DB, a database client, has a path traversal flaw in its class generator, where the tableName argument is not restricted. A remote attacker can use it to read or write files outside the intended directory on the server running Chat2DB.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Chat2DB","fixed":[],"affected":"<= 5.3.8","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["chat2db","database-tools","other","self-hosted"],"not_affected_if":["local-only-use","version-above-5.3.8"],"how_to_check":"- Check whether you run Chat2DB and its version; the affected versions are up to `5.3.8`.\n- Look for Chat2DB exposed on a network address reachable from outside your trusted network.","fix":"unknown: no fixed release found; latest stable v5.3.8 is affected","status":"open","published_at":"2026-11-09T03:16:37+00:00","first_seen_at":"2026-11-09T03:24:19+00:00","triaged_at":"2026-11-09T03:26:24+00:00","updated_at":"2026-11-09T03:27:27+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-09T03:26:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Chat2DB: path traversal in code generator lets remote users write files","impact":"high","summary":"Chat2DB, a database client, has a path traversal flaw in its class generator, where the tableName argument is not restricted. A remote attacker can use it to read or write files outside the intended directory on the server running Chat2DB.","audience":"businesses","category":"other","nicknames":[],"who_cares":["chat2db","self-hosted","database-tools"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker reads or writes arbitrary files on the server","analyst_note":"Confirm whether a fixed version exists and whether authentication or a non-default feature is required, via the NVD entry and the vendor's repository.","how_to_check":"- Check whether you run Chat2DB and its version; the affected versions are up to `5.3.8`.\n- Look for Chat2DB exposed on a network address reachable from outside your trusted network.","plain_action":"","product_name":"Chat2DB","needs_analyst":true,"not_affected_if":["version-above-5.3.8","local-only-use"],"who_is_affected":"Teams running Chat2DB 5.3.8 or earlier that is reachable over the network, particularly where its Mybatis class generation feature is used. Installations limited to a single desktop with no network exposure are lower risk. The sources do not say whether the feature must be enabled or whether authentication is required.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000739,"input_tokens":4598,"output_tokens":559,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether a fixed version exists and whether authentication or a non-default feature is required, via the NVD entry and the vendor's repository.","search":"'-124557':14A,17A '-2026':13A,16A '5.3.8':76C 'argument':43B,95C 'attack':49B,102C 'chat2db':1A,18A,19B,27B,66B,73C 'class':38B,89C 'client':30B 'code':5A 'compon':88C 'contact':120C 'cve':12A,15A 'databas':21B,29B 'database-tool':20B 'dbmybatisgenerateserviceimpl.generateclass':81C 'dbmybatisgenerateserviceimpl.java':85C 'detect':70C 'directori':61B 'disclosur':124C 'earli':121C 'exploit':109C 'file':11A,57B,84C 'flaw':35B 'function':80C 'generat':6A,39B,90C 'host':26B 'impact':77C 'intend':60B 'let':7A 'manipul':92C 'may':103C,114C 'ottermind':72C 'outsid':58B 'path':2A,33B,99C 'perform':105C 'public':112C 'read':54B 'remot':8A,48B,107C 'respond':128C 'restrict':46B 'result':97C 'run':65B 'self':25B 'self-host':24B 'server':64B 'tablenam':42B,96C 'tool':22B 'travers':3A,34B,100C 'use':51B,116C 'user':9A 'vendor':118C 'vulner':68C 'way':131C 'write':10A,56B","nicknames":[],"mitigations":[],"who_affected":"Teams running Chat2DB 5.3.8 or earlier with the web server reachable over a network. The CVSS vector from VulDB indicates no privileges needed, but we have not read the vendor's code or advisory to confirm that. The vendor did not respond to the researcher and we found no fixed release; v5.3.8 is the latest stable release, so it is itself in the affected range. Single-user desktop installs with no network exposure are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["chat2db"],"ptokens":["chat2db"],"labels":["chat2db","databasetools","high","other","selfhosted","vendor"],"campaign_type":null,"search_a":"'-124557':14A,17A '-2026':13A,16A 'chat2db':1A,18A 'code':5A 'cve':12A,15A 'file':11A 'generat':6A 'let':7A 'path':2A 'remot':8A 'travers':3A 'user':9A 'write':10A","search_b":"'argument':43B 'attack':49B 'chat2db':19B,27B,66B 'class':38B 'client':30B 'databas':21B,29B 'database-tool':20B 'directori':61B 'file':57B 'flaw':35B 'generat':39B 'host':26B 'intend':60B 'outsid':58B 'path':33B 'read':54B 'remot':48B 'restrict':46B 'run':65B 'self':25B 'self-host':24B 'server':64B 'tablenam':42B 'tool':22B 'travers':34B 'use':51B 'write':56B","search_c":"'5.3.8':76C 'argument':95C 'attack':102C 'chat2db':73C 'class':89C 'compon':88C 'contact':120C 'dbmybatisgenerateserviceimpl.generateclass':81C 'dbmybatisgenerateserviceimpl.java':85C 'detect':70C 'disclosur':124C 'earli':121C 'exploit':109C 'file':84C 'function':80C 'generat':90C 'impact':77C 'manipul':92C 'may':103C,114C 'ottermind':72C 'path':99C 'perform':105C 'public':112C 'remot':107C 'respond':128C 'result':97C 'tablenam':96C 'travers':100C 'use':116C 'vendor':118C 'vulner':68C 'way':131C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T03:16:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124557","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124557","severity":null,"published_at":"2026-11-09T03:16:37+00:00","modified_at":"2026-11-09T03:16:37+00:00","first_seen_at":"2026-11-09T03:24:19+00:00","fetched_at":"2026-11-09T03:24:19+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124557:2238","url":null,"severity":null,"published_at":"2026-11-09T03:27:27+00:00","modified_at":"2026-11-09T03:27:27+00:00","first_seen_at":"2026-11-09T03:27:27+00:00","fetched_at":"2026-11-09T03:27:27+00:00","note":"web-cli out of credits; NVD page unreadable via WebFetch. GitHub releases page (CodePhiliaX/Chat2DB) shows latest stable v5.3.8 (09 Oct) and 5.3.9-beta.2, no mention of a path traversal fix. NVD description says affected up to 5.3.8, vendor did not respond, exploit public. Auth/feature requirements unknown (CVSS vector says PR:N, network). Nothing verified; no primary advisory found. Revisit when web-cli works: check VulDB entry and the GitHub issue for the PoC."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}