Which versions of Java are affected by EUVD-2026-14423?

Organizations using CodePhiliaX Chat2DB should be aware of moderate risk from CVE-2026-4586, a unrestricted file upload vulnerability rated CVSS 6.3. This could allow unauthorized file access.

Is there a public PoC exploit available for EUVD-2026-14423?

Yes, a public proof-of-concept exploit is available for EUVD-2026-14423. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-14423?

Within 30 days: Identify affected systems running CodePhiliaX Chat2DB and apply vendor patches as part of regular patch cycle. Review file handling controls.

Java EUVD-2026-14423

Q: What is the CVSS score of EUVD-2026-14423?

EUVD-2026-14423 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-4586 LOW

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-03-23 VulDB

GHSA-79h5-mg2m-5mfm

Java File Upload

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVSS changed

Apr 24, 2026 - 16:37 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

PoC Detected

Mar 23, 2026 - 14:31 vuln.today

Public exploit code

EUVD ID Assigned

Mar 23, 2026 - 12:45 euvd

EUVD-2026-14423

Analysis Generated

Mar 23, 2026 - 12:45 vuln.today

CVE Published

Mar 23, 2026 - 12:08 nvd

MEDIUM 6.3

DescriptionCVE.org

A vulnerability was found in CodePhiliaX Chat2DB up to 0.3.7. This affects the function Upload of the file chat2db-server/chat2db-server-web/chat2db-server-web-api/src/main/java/ai/chat2db/server/web/api/controller/driver/JdbcDriverController.java of the component JDBC Driver Upload. Performing a manipulation results in unrestricted upload. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

An unrestricted file upload vulnerability exists in CodePhiliaX Chat2DB versions up to 0.3.7 in the JDBC Driver Upload functionality, allowing authenticated attackers to upload arbitrary files to the server. The vulnerability affects the JdbcDriverController.java component and has a CVSS score of 6.3 (medium severity) with a public proof-of-concept exploit available, though the vendor has not responded to disclosure attempts.

Technical ContextAI

The vulnerability resides in the JDBC Driver Upload component (JdbcDriverController.java) within the Chat2DB server web API layer, which is written in Java. The root cause is classified as CWE-434: Unrestricted Upload of File with Dangerous Type, indicating insufficient validation of uploaded file types and content. Chat2DB is a database management and SQL IDE tool that integrates JDBC drivers for database connectivity; the upload function is intended for driver management but lacks proper file type validation and sanitization. The attack surface is the HTTP API endpoint handling driver uploads, accessible to authenticated users over the network (AV:N).

RemediationAI

Immediately upgrade Chat2DB to a version newer than 0.3.7 if available from the vendor; however, given the lack of vendor response, verify with CodePhiliaX or monitor their repository for patches. As a primary mitigation, disable or restrict access to the JDBC Driver Upload API endpoint to only trusted administrators using network-level access controls (firewall rules, VPN). Implement strict file upload validation by configuring a Web Application Firewall (WAF) to reject uploads with dangerous extensions (e.g., .jar, .exe, .class) and enforce Content-Type validation. Additionally, configure the application to disable dynamic loading of uploaded drivers if possible, or isolate the driver loading process in a sandboxed environment with minimal privileges. Monitor uploaded files using antivirus or file integrity monitoring tools.