Databasement CVE-2026-103533

Requires an authenticated high-privilege account (PR:H) able to invoke the restore operation on the database-servers API endpoint (app/Http/Requests/Api/V1/RestoreRequest.php). The traversal is triggered by the schema_name argument during a restore for database types whose name is written directly to a filesystem path (SQLite and Firebird, per the patch, which added SafeDatabasePath checks to those DatabaseType rules). Limiting factors: exploitation is network-reachable but rated difficult/high-complexity (AC:H), demands prior privileged authentication, and only affects databasement versions up to 1.7.1 (fixed in 1.7.2); impact is limited to low confidentiality/integrity/availability with no scope change to other systems.

This is a low-real-risk issue despite being a network-exploitable path traversal. The CVSS 4.0 base score is only 1.2 and all signals converge on low priority: the vendor vector is CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N with only low vulnerable-system impact (VC:L/VI:L/VA:L) and no scope change. Critically, it requires high privileges (PR:H - an authenticated, high-privilege operator of the restore/database-servers API) AND high attack complexity (AC:H), which the description reinforces ('A high complexity level is associated with this attack. The exploitability is said to be difficult'). The threat intelligence (E:P) and references confirm publicly available exploit code exists (a GitHub security advisory GHSA-x225-463f-pgww), but this is distinct from active exploitation: there is no CISA KEV listing and no EPSS score provided, so there is no evidence of in-the-wild use. The POC lowers the bar to replicate but does not change that the attacker must already hold a privileged, authenticated role on the appliance. No conflicting signals: the CVSS vector (network, high-complexity, high-privilege) is consistent with the description of a privileged restore operation manipulating schema_name.

A high-privilege authenticated user of the databasement API crafts a database restore request to the database-servers endpoint with a malicious schema_name containing traversal sequences (e.g. ../../), causing the restore to write to a file path outside the intended directory. Because a SQLite/Firebird restore writes to the resolved path directly, the manipulated name redirects the write. Public exploit code exists via the vendor's GitHub security advisory, but the attack is rated difficult (AC:H) and requires an existing privileged account (PR:H).