---
id: "CVE-2026-92187"
kind: "vulnerability"
aliases: ["CVE-2026-92187"]
title: "Quest Foglight for Databases: path traversal lets authenticated users run code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Foglight for Databases", "fixed": ["8.3"], "affected": "< 8.3 (lower bound not stated)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["database-monitoring", "other", "quest-foglight", "self-hosted", "windows"]
not_affected_if: ["auth-required", "no-foglight-installed"]
published_at: "2026-11-04T00:17:28+00:00"
first_seen_at: "2026-11-04T00:46:18+00:00"
updated_at: "2026-11-04T00:53:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92187", "first_seen_at": "2026-11-04T00:46:18+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T00:53:39+00:00"}]
---

# Quest Foglight for Databases: path traversal lets authenticated users run code

Quest Foglight for Databases has a directory traversal flaw in its extractAndCreateUploadInfoList method, which trusts a user-supplied path when writing files. An authenticated attacker can use it to execute arbitrary code as SYSTEM on the affected server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Foglight for Databases affected < 8.3 (lower bound not stated) fixed 8.3

## How to check

Check the installed Foglight version in the Foglight management server (Help > About, or the install directory). Versions earlier than 8.3 should be treated as exposed; ZDI gives no lower bound. Also check which accounts can log in to Foglight, since the attack needs a valid login.

## Fix

Upgrade Quest Foglight to 8.3 (per ZDI-26-852; Quest's own advisory not found)

## Timeline

- 2026-11-04T00:46:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92187
- 2026-11-04T00:53:39+00:00 analyst — ZDI-26-852 (reported 2026-05-21, public 2026-11-03) says 'Fixed in Foglight 8.3'. ZDI is the discoverer, not Quest, so no field marked verified. No Quest advisory found; no exact affected range stated. Sibling ZDI-26-855/857/858/860/866 are separate Foglight for Databases traversal bugs also fixed in 8.3.

## Documents

- [advisory] ZDI-26-852: Quest Foglight for Databases extractAndCreateUploadInfoList Directory Traversal RCE https://www.zerodayinitiative.com/advisories/ZDI-26-852/

## From the sources

Quest Foglight for Databases extractAndCreateUploadInfoList Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability.

The specific flaw exists within the extractAndCreateUploadInfoList method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29039.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_