EUVD-2026-63422
GHSA-7gx5-3cjh-4p7m
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-accessible admin endpoint (AV:N), no race or complexity required (AC:L), administrator credentials mandatory (PR:H), and root-level code execution yields full C/I/A impact with no scope change.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
Lifecycle Timeline
2DescriptionCVE.org
Heimdall Data Database Proxy uploadJar Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Heimdall Data Database Proxy. Authentication is required to exploit this vulnerability.
The specific flaw exists within the uploadJar method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-28603.
AnalysisAI
Remote code execution in Heimdall Data Database Proxy enables authenticated high-privilege attackers to run arbitrary code as root via a directory traversal flaw in the uploadJar method. The vulnerability, tracked as ZDI-CAN-28603 and published by Zero Day Initiative as ZDI-26-479, stems from the absence of proper path validation on user-supplied input before use in file operations, allowing arbitrary JAR placement on the underlying filesystem. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session with high-privilege (administrator-level) access to the Heimdall Data Database Proxy, confirmed by the CVSS vector PR:H and explicitly stated in the CVE description ('Authentication is required to exploit this vulnerability'). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.0 base score of 7.2 is internally consistent: AV:N reflects a network-reachable upload endpoint, AC:L indicates no special timing or race condition is required, and PR:H correctly captures that only administrator-level credentials can invoke uploadJar. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to apply a vendor-released patch from Heimdall Data addressing the uploadJar path-traversal flaw; however, no specific patched version is confirmed in the available data - consult the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-26-479/ and the vendor directly for current patch availability and target version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running Heimdall Data Database Proxy and document active administrative user accounts with uploadJar access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Database Proxy
View allSame weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today