Chat2DB EUVD-2026-119779

Requires network access to a Chat2DB instance (up to and including 5.3.8) exposing the Class Generator / MyBatis class-generation feature, with attacker control over the tableName argument passed to DbMybatisGenerateServiceImpl.generateClass. The CVSS vector lists PR:N and UI:N (no authentication or user interaction stated), but the description does not confirm whether the generator is reachable without a logged-in session, so pre-authentication exposure should be validated per deployment. Exploitation is limited by the uniformly LOW impact ceiling (partial file read/write, no scope change) and by the fact that no fixed version is available, since the vendor did not respond to the disclosure.

Signals point to a moderate, not emergency, priority. The CVSS 4.0 base score is 6.9 (medium) with vector AV:N/AC:L/AT:N/PR:N/UI:N and uniformly LOW vulnerable-system impacts (VC:L/VI:L/VA:L, SC/SI/SA:N), so even successful exploitation yields only partial file read/write rather than full system compromise. The E:P (Proof-of-Concept) threat metric and the description's claim that 'the exploit is now public' indicate exploit material circulates, but no EPSS score and no CISA KEV entry are present in the input, so there is no evidence of active, widespread exploitation - this is a disclosed-with-PoC issue, not a confirmed in-the-wild campaign. The vuln.today Decision label is 'this_month' (routine patch cycle), consistent with the medium severity. Caveat on authentication: the CVSS vector asserts PR:N (unauthenticated), yet the flaw lives in an application-level Class Generator feature whose reachability may in practice require access to a running Chat2DB instance or a logged-in session; the description does not confirm whether the generator is exposed pre-authentication, so the unauthenticated assumption should be verified against the actual deployment. Sourcing is single-origin (VulDB, mirrored to ENISA EUVD), and the vendor was contacted but did not respond, so no independent vendor confirmation or patch exists.

A remote attacker reaches the Chat2DB Class Generator function and submits a tableName value containing directory-traversal sequences (e.g. ../), causing DbMybatisGenerateServiceImpl.generateClass to resolve a file path outside the intended output directory and read or write a file there. A public PoC reference exists per the disclosure, though it is not verified as working exploit code. With AV:N/AC:L the request is low-complexity and network-reachable, but impact is bounded to the LOW confidentiality/integrity/availability indicated by the vector.