{"id":"CVE-2026-92187","kind":"vulnerability","aliases":["CVE-2026-92187"],"related":[],"title":"Quest Foglight for Databases: path traversal lets authenticated users run code","description":"Quest Foglight for Databases extractAndCreateUploadInfoList Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the extractAndCreateUploadInfoList method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29039.","summary":"Quest Foglight for Databases has a directory traversal flaw in its extractAndCreateUploadInfoList method, which trusts a user-supplied path when writing files. An authenticated attacker can use it to execute arbitrary code as SYSTEM on the affected server.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Foglight for Databases","fixed":["8.3"],"affected":"< 8.3 (lower bound not stated)","ecosystem":"vendor"}],"ecosystems":[],"tags":["database-monitoring","other","quest-foglight","self-hosted","windows"],"not_affected_if":["auth-required","no-foglight-installed"],"how_to_check":"Check the installed Foglight version in the Foglight management server (Help > About, or the install directory). Versions earlier than 8.3 should be treated as exposed; ZDI gives no lower bound. Also check which accounts can log in to Foglight, since the attack needs a valid login.","fix":"Upgrade Quest Foglight to 8.3 (per ZDI-26-852; Quest's own advisory not found)","status":"open","published_at":"2026-11-04T00:17:28+00:00","first_seen_at":"2026-11-04T00:46:18+00:00","triaged_at":"2026-11-04T00:47:42+00:00","updated_at":"2026-11-04T00:53:39+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-04T00:47:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Quest Foglight for Databases: path traversal lets authenticated users run code","impact":"high","summary":"Quest Foglight for Databases has a directory traversal flaw in its extractAndCreateUploadInfoList method, which trusts a user-supplied path when writing files. An authenticated attacker can use it to execute arbitrary code as SYSTEM on the affected server.","audience":"businesses","category":"other","nicknames":[],"who_cares":["quest-foglight","windows","database-monitoring"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Code runs as SYSTEM on the monitoring server","analyst_note":"Find affected version ranges and vendor fix from Quest advisory or ZDI-CAN-29039 page; NVD link is the only source given.","how_to_check":"- Check whether Quest Foglight for Databases is installed on the server and which version it runs (version not stated in the sources)\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-foglight-installed","auth-required"],"who_is_affected":"Any installation of Quest Foglight for Databases is potentially exposed, since the flaw is in its upload extraction handling. Attacker must hold valid credentials for the product. The sources do not list affected version ranges.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000676,"input_tokens":4238,"output_tokens":505,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected version ranges and vendor fix from Quest advisory or ZDI-CAN-29039 page; NVD link is the only source given.","search":"'-2026':13A,16A '-92187':14A,17A '29039':154C 'affect':69B,92C 'allow':84C 'arbitrari':63B,89C 'attack':57B,86C,137C 'authent':8A,56B,99C 'code':11A,64B,79C,90C,144C 'context':147C 'cve':12A,15A 'databas':4A,22B,35B,74C,98C 'database-monitor':21B 'databases':20A 'directori':38B,76C 'execut':62B,80C,88C,143C 'exist':109C 'exploit':103C 'extractandcreateuploadinfolist':43B,75C,112C 'file':54B,134C 'flaw':40B,108C 'foglight':2A,18A,27B,33B,72C,96C 'for':19A 'host':30B 'instal':93C 'issu':115C 'lack':119C 'let':7A 'leverag':139C 'method':44B,113C 'monitor':23B 'oper':135C 'path':5A,51B,128C 'prior':129C 'proper':121C 'quest':1A,26B,32B,71C,95C 'quest-foglight':25B 'remot':78C,85C 'requir':101C 'result':116C 'run':10A 'self':29B 'self-host':28B 'server':70B 'specif':107C 'suppli':50B,127C 'system':66B,149C 'travers':6A,39B,77C 'trust':46B 'use':59B,131C 'user':9A,49B,126C 'user-suppli':48B,125C 'valid':122C 'vulner':81C,83C,105C,141C 'window':31B 'within':110C 'write':53B 'zdi':152C 'zdi-can':151C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Quest Foglight for Databases (the management server, which runs as SYSTEM on Windows) on a version earlier than 8.3. An attacker needs a valid Foglight login and network access to the web interface, then can write files to chosen paths and run code as SYSTEM. Teams without Foglight, or on 8.3 or later, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["foglightfordatabases","fordatabases"],"ptokens":["databases","foglight","for"],"labels":["databasemonitoring","high","other","questfoglight","selfhosted","windows"],"campaign_type":null,"first_public_at":"2026-11-04T00:17:28+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92187","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92187","severity":null,"published_at":"2026-11-04T00:17:28+00:00","modified_at":"2026-11-04T00:17:28+00:00","first_seen_at":"2026-11-04T00:46:18+00:00","fetched_at":"2026-11-04T00:46:18+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-92187:1607","url":null,"severity":null,"published_at":"2026-11-04T00:53:39+00:00","modified_at":"2026-11-04T00:53:39+00:00","first_seen_at":"2026-11-04T00:53:39+00:00","fetched_at":"2026-11-04T00:53:39+00:00","note":"ZDI-26-852 (reported 2026-05-21, public 2026-11-03) says 'Fixed in Foglight 8.3'. ZDI is the discoverer, not Quest, so no field marked verified. No Quest advisory found; no exact affected range stated. Sibling ZDI-26-855/857/858/860/866 are separate Foglight for Databases traversal bugs also fixed in 8.3."}],"documents":[{"id":62181,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-852/","title":"ZDI-26-852: Quest Foglight for Databases extractAndCreateUploadInfoList Directory Traversal RCE","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}