Chat2db EUVD-2026-14423

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) indicates a medium-severity issue requiring network access, low attack complexity, and low privileges (authenticated user), with limited impact on confidentiality, integrity, and availability. The exploitation probability is marked as Proof-of-Concept (E:P) with unspecified reliability (RL:X), and the exploit has been publicly disclosed and is available on Feishu. Despite the public POC, the practical risk depends on deployment context: in closed corporate environments with trusted users, risk is lower; in multi-tenant or internet-facing deployments, the threat is significant. The lack of vendor response (RL:X) suggests no patch availability, elevating operational risk. Real-world priority should be HIGH for exposed instances, MEDIUM for internal deployments, due to the combination of public exploitability, ease of attack (authenticated but low-friction), and the potential for arbitrary code execution if malicious JAR files are uploaded and loaded by the application.

An authenticated user (such as a compromised account or insider) accesses the Chat2DB web API and uploads a malicious JAR file through the JDBC Driver Upload endpoint by bypassing or circumventing file type validation. Once uploaded, if the application automatically loads or executes the JAR as a JDBC driver, the attacker can achieve remote code execution (RCE) on the server with the privileges of the Chat2DB process, potentially compromising the database and other connected systems. The attack is straightforward due to low complexity (AC:L) and the availability of a public proof-of-concept exploit, making it attractive for both opportunistic attackers and targeted intrusions.