{"id":"CVE-2026-92197","kind":"vulnerability","aliases":["CVE-2026-92197"],"related":[],"title":"Quest Foglight for Databases: directory traversal in unzipFile allows code execution","description":"Quest Foglight for Databases unzipFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the unzipFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29901.","summary":"Quest Foglight for Databases has a path validation flaw in its unzipFile method that lets a user-supplied path write files outside the intended directory. An authenticated attacker can use it to execute code as SYSTEM.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Foglight for Databases","fixed":["8.3"],"affected":"8.2.0 (CVE record); earlier versions not stated","ecosystem":"vendor"}],"ecosystems":[],"tags":["database-monitoring","other","quest-foglight","windows"],"not_affected_if":["not-running-foglight"],"how_to_check":"Check your Foglight version in the Foglight web console (About) or installer; the CVE record lists 8.2.0 as affected, and ZDI says fixed in 8.3. Versions between are not stated.","fix":"Upgrade Quest Foglight for Databases to Foglight 8.3 (per ZDI-26-860; Quest's own advisory not found).","status":"open","published_at":"2026-11-04T00:17:30+00:00","first_seen_at":"2026-11-04T00:46:19+00:00","triaged_at":"2026-11-04T00:47:37+00:00","updated_at":"2026-11-04T00:51:30+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-11-04T00:47:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Quest Foglight for Databases: directory traversal in unzipFile allows code execution","impact":"high","summary":"Quest Foglight for Databases has a path validation flaw in its unzipFile method that lets a user-supplied path write files outside the intended directory. An authenticated attacker can use it to execute code as SYSTEM.","audience":"businesses","category":"other","nicknames":[],"who_cares":["quest-foglight","windows","database-monitoring"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Code runs as SYSTEM on the monitoring server","analyst_note":"Check the ZDI advisory ZDI-CAN-29901 and Quest's vendor advisory for affected and fixed versions, and whether a patch is out.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["not-running-foglight"],"who_is_affected":"Organizations running Quest Foglight for Databases, where the flaw sits in the unzipFile method that handles user-supplied paths. The sources do not say which versions are affected or which configurations are exposed. Teams that do not run Foglight for Databases can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000655,"input_tokens":4211,"output_tokens":468,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the ZDI advisory ZDI-CAN-29901 and Quest's vendor advisory for affected and fixed versions, and whether a patch is out.","search":"'-2026':13A,16A '-92197':14A,17A '29901':149C 'affect':87C 'allow':9A,79C 'arbitrari':84C 'attack':57B,81C,132C 'authent':56B,94C 'code':10A,63B,74C,85C,139C 'context':142C 'cve':12A,15A 'databas':4A,22B,32B,69C,93C 'database-monitor':21B 'databases':20A 'directori':5A,54B,71C 'execut':11A,62B,75C,83C,138C 'exist':104C 'exploit':98C 'file':50B,129C 'flaw':37B,103C 'foglight':2A,18A,27B,30B,67C,91C 'for':19A 'instal':88C 'intend':53B 'issu':110C 'lack':114C 'let':43B 'leverag':134C 'method':41B,108C 'monitor':23B 'oper':130C 'outsid':51B 'path':35B,48B,123C 'prior':124C 'proper':116C 'quest':1A,26B,29B,66C,90C 'quest-foglight':25B 'remot':73C,80C 'requir':96C 'result':111C 'specif':102C 'suppli':47B,122C 'system':65B,144C 'travers':6A,72C 'unzipfil':8A,40B,70C,107C 'use':59B,126C 'user':46B,121C 'user-suppli':45B,120C 'valid':36B,117C 'vulner':76C,78C,100C,136C 'window':28B 'within':105C 'write':49B 'zdi':147C 'zdi-can':146C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Quest Foglight for Databases (CVE record lists 8.2.0; ZDI says fixed in Foglight 8.3). An attacker needs a valid login, then can write files outside the intended directory through the unzipFile method and run code as SYSTEM on the Foglight server. Teams not running Foglight can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["foglightfordatabases","fordatabases"],"ptokens":["databases","foglight","for"],"labels":["databasemonitoring","high","other","questfoglight","windows"],"campaign_type":null,"first_public_at":"2026-11-04T00:17:30+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92197","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92197","severity":null,"published_at":"2026-11-04T00:17:30+00:00","modified_at":"2026-11-04T00:17:30+00:00","first_seen_at":"2026-11-04T00:46:19+00:00","fetched_at":"2026-11-04T00:46:19+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-92197:1601","url":null,"severity":null,"published_at":"2026-11-04T00:51:30+00:00","modified_at":"2026-11-04T00:51:30+00:00","first_seen_at":"2026-11-04T00:51:30+00:00","fetched_at":"2026-11-04T00:51:30+00:00","note":"ZDI-26-860 (Nov 3 2026) says fixed in Foglight 8.3, reported to vendor 2026-05-21; CVE record lists 8.2.0 affected. No Quest advisory found, no exploitation or PoC reported (OffSeq: not in KEV). Sibling ZDI-26-855..858, 866 are other Foglight traversal bugs, same fix. Nothing marked verified since ZDI is not the vendor."}],"documents":[{"id":62165,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-860/","title":"ZDI-26-860 Quest Foglight for Databases unzipFile","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}