Foglight for Databases CVE-2026-92193

Requires an authenticated session to the Quest Foglight for Databases web application (PR:L); the attacker then reaches the FileServlet endpoint and supplies a user-controlled file path that the servlet uses in file operations without proper validation. No non-default configuration is indicated as necessary - the weakness is in the FileServlet code path itself. The primary limiting factor is the authentication requirement, which restricts exploitation to users who already have valid Foglight credentials; no user interaction by a victim is needed, and the file read occurs with SYSTEM privileges, so the authorization boundary rather than any special feature toggle is what gates the attack.

This is a medium-severity, moderate-priority issue rather than a drop-everything emergency. The CVSS 3.0 base score of 6.5 reflects a network-reachable (AV:N), low-complexity (AC:L) flaw that requires authentication (PR:L) and no user interaction (UI:N), with high confidentiality impact (C:H) but no integrity or availability impact (I:N/A:N). The decisive aggravator is that file reads execute in the context of SYSTEM, so an authenticated user can read files far beyond their intended authorization, potentially exposing credentials or configuration that enable further compromise. Countervailing signals keep real-world risk contained: no EPSS score is provided in the input, so exploitation probability cannot be quantified; there is no CISA KEV listing (not confirmed actively exploited); and no public exploit code is identified - the only reference is the ZDI advisory itself, which is a disclosure page, not working exploit code. The vuln.today decision label is 'this_month', consistent with a real but non-urgent priority. The authentication precondition meaningfully limits the attacker population to users who already hold Foglight accounts, so this is better characterized as a privilege/authorization-boundary weakness for existing users than as a widely exploitable unauthenticated bug. No signals conflict; the main gaps are missing EPSS and no fixed-version data in the provided input.

An authenticated Quest Foglight for Databases user sends a crafted request to the FileServlet endpoint supplying an attacker-controlled file path that the servlet fails to validate. Because the file operation runs in the context of SYSTEM, the server returns the contents of files the user should not be able to read - such as configuration files or stored credentials. No public exploit code is identified at time of analysis; only the ZDI advisory reference is available.