---
id: "CVE-2026-124557"
page: "https://infrastack.ai/live/CVE-2026-124557"
kind: "vulnerability"
aliases: ["CVE-2026-124557"]
title: "Chat2DB: path traversal in code generator lets remote users write files"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Chat2DB", "fixed": [], "affected": "<= 5.3.8", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["chat2db", "database-tools", "other", "self-hosted"]
not_affected_if: ["local-only-use", "version-above-5.3.8"]
published_at: "2026-11-09T03:16:37+00:00"
first_seen_at: "2026-11-09T03:24:19+00:00"
updated_at: "2026-11-09T03:27:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124557", "first_seen_at": "2026-11-09T03:24:19+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-09T03:27:27+00:00"}]
exploit_sources: []
---

# Chat2DB: path traversal in code generator lets remote users write files

Link for people: https://infrastack.ai/live/CVE-2026-124557 (this .md is for agents)

Chat2DB, a database client, has a path traversal flaw in its class generator, where the tableName argument is not restricted. A remote attacker can use it to read or write files outside the intended directory on the server running Chat2DB.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Chat2DB affected <= 5.3.8 fixed no fixed version listed

## How to check

- Check whether you run Chat2DB and its version; the affected versions are up to `5.3.8`.
- Look for Chat2DB exposed on a network address reachable from outside your trusted network.

## Fix

unknown: no fixed release found; latest stable v5.3.8 is affected

## Timeline

- 2026-11-09T03:24:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124557
- 2026-11-09T03:27:27+00:00 analyst — web-cli out of credits; NVD page unreadable via WebFetch. GitHub releases page (CodePhiliaX/Chat2DB) shows latest stable v5.3.8 (09 Oct) and 5.3.9-beta.2, no mention of a path traversal fix. NVD description says affected up to 5.3.8, vendor did not respond, exploit public. Auth/feature requirements unknown (CVSS vector says PR:N, network). Nothing verified; no primary advisory found. Revisit when web-cli works: check VulDB entry and the GitHub issue for the PoC.

## From the sources

A vulnerability was detected in OtterMind Chat2DB up to 5.3.8. Impacted is the function DbMybatisGenerateServiceImpl.generateClass of the file DbMybatisGenerateServiceImpl.java of the component Class Generator. The manipulation of the argument tableName results in path traversal. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_