---
id: "CVE-2026-92197"
kind: "vulnerability"
aliases: ["CVE-2026-92197"]
title: "Quest Foglight for Databases: directory traversal in unzipFile allows code execution"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Foglight for Databases", "fixed": ["8.3"], "affected": "8.2.0 (CVE record); earlier versions not stated", "ecosystem": "vendor"}]
ecosystems: []
tags: ["database-monitoring", "other", "quest-foglight", "windows"]
not_affected_if: ["not-running-foglight"]
published_at: "2026-11-04T00:17:30+00:00"
first_seen_at: "2026-11-04T00:46:19+00:00"
updated_at: "2026-11-04T00:51:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92197", "first_seen_at": "2026-11-04T00:46:19+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T00:51:30+00:00"}]
---

# Quest Foglight for Databases: directory traversal in unzipFile allows code execution

Quest Foglight for Databases has a path validation flaw in its unzipFile method that lets a user-supplied path write files outside the intended directory. An authenticated attacker can use it to execute code as SYSTEM.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Foglight for Databases affected 8.2.0 (CVE record); earlier versions not stated fixed 8.3

## How to check

Check your Foglight version in the Foglight web console (About) or installer; the CVE record lists 8.2.0 as affected, and ZDI says fixed in 8.3. Versions between are not stated.

## Fix

Upgrade Quest Foglight for Databases to Foglight 8.3 (per ZDI-26-860; Quest's own advisory not found).

## Timeline

- 2026-11-04T00:46:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92197
- 2026-11-04T00:51:30+00:00 analyst — ZDI-26-860 (Nov 3 2026) says fixed in Foglight 8.3, reported to vendor 2026-05-21; CVE record lists 8.2.0 affected. No Quest advisory found, no exploitation or PoC reported (OffSeq: not in KEV). Sibling ZDI-26-855..858, 866 are other Foglight traversal bugs, same fix. Nothing marked verified since ZDI is not the vendor.

## Documents

- [advisory] ZDI-26-860 Quest Foglight for Databases unzipFile https://www.zerodayinitiative.com/advisories/ZDI-26-860/

## From the sources

Quest Foglight for Databases unzipFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability.

The specific flaw exists within the unzipFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29901.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_