EUVD-2026-74725
GHSA-35r6-7qjq-22gr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable but requires high-privilege authentication; impact is confidentiality-only with no integrity or availability consequence.
Primary rating from Vendor (twcert).
CVSS VectorVendor: twcert
Lifecycle Timeline
1DescriptionCVE.org
The Enterprise Cloud Database developed by Ragic has an Arbitrary File Read vulnerability. Privileged remote attackers can exploit Relative Path Traversal to download arbitrary system files.
AnalysisAI
Relative path traversal in Ragic Enterprise Cloud Database enables privileged remote attackers to read arbitrary files from the underlying server filesystem. Exploitation requires high-privilege authenticated access (PR:H per the CVSS 4.0 vector AV:N/AC:L/AT:N/PR:H), meaning an attacker must first hold or compromise an elevated account within the platform before leveraging the traversal to exfiltrate sensitive system files. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be authenticated to the Ragic Enterprise Cloud Database platform with high-privilege credentials (PR:H per CVSS 4.0). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.9 is calibrated by PR:H, which is the dominant risk-reduction factor: an attacker cannot exploit this unauthenticated and must already possess high-privilege platform access. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the TWCERT advisories at https://www.twcert.org.tw/tw/cp-132-11189-68e64-1.html (Chinese) and https://www.twcert.org.tw/en/cp-139-11190-7a985-2.html (English) for vendor-issued patch details; no exact fixed version number is present in the available data, so direct contact with Ragic support is warranted to obtain the patched release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Enterprise Cloud Database
View allEnterprise Cloud Database from Ragic does not properly validate the file type for uploads. Rated critical severity (CVSS
Enterprise Cloud Database from Ragic does not authenticate access to specific functionality, allowing unauthenticated re
Enterprise Cloud Database from Ragic does not properly validate a specific page parameter, allowing unauthenticated remo
Unrestricted file upload in Ragic Enterprise Cloud Database exposes all versions to unauthenticated remote exploitation,
Rogic No-Code Database Builder's file uploading function has insufficient filtering for special characters. Rated medium
Stored XSS in Ragic Enterprise Cloud Database permits unauthenticated remote attackers to inject persistent JavaScript i
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today