{"id":"CVE-2026-63663","kind":"vulnerability","aliases":["CVE-2026-63663"],"related":[],"title":"CloudBeaver: path traversal lets authenticated users read server files","description":"CloudBeaver is a cloud database manager. From version 23.2.3 until 26.1.2, a path traversal vulnerability in its SQL result-editing functionality allows an authenticated user with SQL result-editing privileges to cause the server to open files outside the intended temporary upload directory. In affected database value-handling scenarios, this can disclose local files readable by the CloudBeaver server process. Version 26.1.2 prevents traversal outside the intended temporary upload directory.","summary":"CloudBeaver, a cloud database manager, has a path traversal flaw in its SQL result-editing feature. An authenticated user with result-editing rights can make the server open files outside its temporary upload directory and disclose local files the server process can read.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloudbeaver","database","other","self-hosted"],"not_affected_if":["no-result-editing-users","version-outside-range"],"how_to_check":"- Check the CloudBeaver version in use; versions from `23.2.3` up to but not including `26.1.2` are listed as affected\n- Confirm whether users with SQL result-editing privileges exist on the instance","fix":"- CloudBeaver: move to `26.1.2` or later","status":"open","published_at":"2026-11-06T20:17:23+00:00","first_seen_at":"2026-11-06T20:44:00+00:00","triaged_at":"2026-11-06T20:44:17+00:00","updated_at":"2026-11-06T20:44:17+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-06T20:44:17Z","model":"claude-haiku-5-5","output":{"fix":"- CloudBeaver: move to `26.1.2` or later","reach":"network","title":"CloudBeaver: path traversal lets authenticated users read server files","impact":"medium","summary":"CloudBeaver, a cloud database manager, has a path traversal flaw in its SQL result-editing feature. An authenticated user with result-editing rights can make the server open files outside its temporary upload directory and disclose local files the server process can read.","audience":"businesses","category":"other","nicknames":[],"who_cares":["cloudbeaver","self-hosted","database"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user reads local files readable by the server","analyst_note":"","how_to_check":"- Check the CloudBeaver version in use; versions from `23.2.3` up to but not including `26.1.2` are listed as affected\n- Confirm whether users with SQL result-editing privileges exist on the instance","plain_action":"","needs_analyst":false,"not_affected_if":["version-outside-range","no-result-editing-users"],"who_is_affected":"Teams running CloudBeaver from 23.2.3 up to 26.1.2 where users have SQL result-editing privileges. The attacker must already hold an account with that privilege, and the flaw leaks files readable by the CloudBeaver server process. Instances on versions outside that range, or where no user holds result-editing rights, are not exposed by this description.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000694,"input_tokens":4288,"output_tokens":531,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-63663':12A,15A '23.2.3':75C '26.1.2':77C,131C 'affect':113C 'allow':89C 'authent':5A,40B,91C 'caus':100C 'cloud':24B,70C 'cloudbeav':1A,16B,22B,67C,127C 'cve':10A,13A 'databas':17B,25B,71C,114C 'directori':57B,111C,139C 'disclos':59B,121C 'edit':37B,45B,87C,97C 'featur':38B 'file':9A,52B,61B,105C,123C 'flaw':31B 'function':88C 'handl':117C 'host':21B 'intend':108C,136C 'let':4A 'local':60B,122C 'make':48B 'manag':26B,72C 'open':51B,104C 'outsid':53B,106C,134C 'path':2A,29B,79C 'prevent':132C 'privileg':98C 'process':64B,129C 'read':7A,66B 'readabl':124C 'result':36B,44B,86C,96C 'result-edit':35B,43B,85C,95C 'right':46B 'scenario':118C 'self':20B 'self-host':19B 'server':8A,50B,63B,102C,128C 'sql':34B,84C,94C 'temporari':55B,109C,137C 'travers':3A,30B,80C,133C 'upload':56B,110C,138C 'user':6A,41B,92C 'valu':116C 'value-handl':115C 'version':74C,130C 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Teams running CloudBeaver from 23.2.3 up to 26.1.2 where users have SQL result-editing privileges. The attacker must already hold an account with that privilege, and the flaw leaks files readable by the CloudBeaver server process. Instances on versions outside that range, or where no user holds result-editing rights, are not exposed by this description.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cloudbeaver","database","medium","other","selfhosted"],"campaign_type":null,"search_a":"'-2026':11A,14A '-63663':12A,15A 'authent':5A 'cloudbeav':1A 'cve':10A,13A 'file':9A 'let':4A 'path':2A 'read':7A 'server':8A 'travers':3A 'user':6A","search_b":"'authent':40B 'cloud':24B 'cloudbeav':16B,22B 'databas':17B,25B 'directori':57B 'disclos':59B 'edit':37B,45B 'featur':38B 'file':52B,61B 'flaw':31B 'host':21B 'local':60B 'make':48B 'manag':26B 'open':51B 'outsid':53B 'path':29B 'process':64B 'read':66B 'result':36B,44B 'result-edit':35B,43B 'right':46B 'self':20B 'self-host':19B 'server':50B,63B 'sql':34B 'temporari':55B 'travers':30B 'upload':56B 'user':41B","search_c":"'23.2.3':75C '26.1.2':77C,131C 'affect':113C 'allow':89C 'authent':91C 'caus':100C 'cloud':70C 'cloudbeav':67C,127C 'databas':71C,114C 'directori':111C,139C 'disclos':121C 'edit':87C,97C 'file':105C,123C 'function':88C 'handl':117C 'intend':108C,136C 'local':122C 'manag':72C 'open':104C 'outsid':106C,134C 'path':79C 'prevent':132C 'privileg':98C 'process':129C 'readabl':124C 'result':86C,96C 'result-edit':85C,95C 'scenario':118C 'server':102C,128C 'sql':84C,94C 'temporari':109C,137C 'travers':80C,133C 'upload':110C,138C 'user':92C 'valu':116C 'value-handl':115C 'version':74C,130C 'vulner':81C","first_public_at":"2026-09-25T06:56:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63663","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63663","severity":null,"published_at":"2026-11-06T20:17:23+00:00","modified_at":"2026-11-06T20:17:24+00:00","first_seen_at":"2026-11-06T20:44:00+00:00","fetched_at":"2026-11-06T20:44:00+00:00","note":null}],"documents":[{"id":89807,"url":"https://github.com/dbeaver/cloudbeaver/commit/caef729a8d227b0446eab6f0ae5f1dc20dced9b5","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":89808,"url":"https://github.com/dbeaver/cloudbeaver/security/advisories/GHSA-8wr4-mh28-m992","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-25T06:56:49+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}