ArcadeDB CVE-2026-75855

Exploitation requires possession of a valid ArcadeDB root user account (the highest-privilege role within ArcadeDB, distinct from standard database users). The POST /api/v1/server endpoint must be network-reachable by the attacker. No non-default configuration is required beyond the root credential - the vulnerable code path is exercised by ordinary create database and drop database API operations available to any authenticated root user on any default ArcadeDB installation before 26.8.1. Exploitation is bounded by two concrete limiting factors: first, the root authentication requirement (PR:H) means standard ArcadeDB users cannot trigger this; second, the OS process account under which ArcadeDB runs constrains which filesystem paths are actually reachable via traversal - if the server process runs as a restricted OS user with limited filesystem access, the attacker's write and delete radius is correspondingly limited.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H) reflects network-accessible, low-complexity exploitation requiring only root-level ArcadeDB credentials, with no confidentiality impact but high integrity and availability impact on both the ArcadeDB process and subsequent OS-level filesystem components (SI:H/SA:H). The PR:H requirement is the primary risk mitigator here - this is not a zero-authentication attack, and opportunistic mass exploitation is implausible without first compromising root credentials. EPSS data was not provided in available intelligence, so exploitation probability cannot be independently quantified. The CVE is absent from CISA KEV and no public POC has been identified, indicating this is not actively exploited in the wild at time of analysis. Despite the elevated CVSS score, realistic risk is concentrated in insider threat scenarios, credential-compromise chains, or environments where ArcadeDB root access is widely shared. The recursive deletion capability raises the availability risk: an attacker could cause catastrophic, potentially unrecoverable data loss in one operation.

An attacker who has obtained valid ArcadeDB root credentials - through credential stuffing, insider access, or a prior compromise - sends a crafted HTTP POST to /api/v1/server with a database name such as ../../etc/cron.d/backdoor to write an attacker-controlled file to a sensitive OS path, establishing persistence. Alternatively, the attacker issues a drop database command with a traversal path targeting a critical data directory (e.g., ../../var/lib/postgresql), triggering recursive deletion and causing catastrophic service disruption. No public POC has been identified at time of analysis, but the technique requires only standard HTTP tooling and knowledge of the API format.