Databasement EUVD-2026-97123

Exploitation requires an authenticated account on the Databasement instance (PR:L) with the ability to create or edit a database-server backup configuration and supply attacker-controlled dump arguments (the patched 'dump_flags' field, or per the description a database name). The attacker must inject a path-redirecting client option - e.g. mariadb-dump --result-file / -r, --tab, pg_dump --file, mongodump --out, redis-cli --rdb/--eval - and the chosen output path must be web-accessible (e.g. /app/public) and interpretable as code (PHP) for RCE. Limiting factors: valid authentication is needed (not unauthenticated); the flaw applies to engines whose dump command appends extra flags (SQLite is excluded per the fix comment); and achieving code execution specifically depends on writing into a web-served, PHP-executing directory rather than merely writing an arbitrary file.

Signals are moderately strong but not top-tier-emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H, score 8.8 HIGH) describes a network-reachable, low-complexity flaw needing only low privileges (PR:L = an authenticated user) and no user interaction, yielding full confidentiality/integrity/availability impact via RCE - consistent with CWE-88 argument injection. A public exploit exists (GHSA-hm57-pvxc-4pcm, marked 'exploit' in references), which raises practical risk above a theoretical bug. However, this is NOT confirmed actively exploited: it is absent from CISA KEV in the provided data. No EPSS score was supplied, so widespread-exploitation probability cannot be quantified - EPSS data is MISSING. The dominant risk-limiter is deployment footprint: 'databasement' is an obscure self-hosted project (the description itself notes it is not even published as an independent Composer package), so despite the high CVSS this is far more a targeted/opportunistic risk against the few exposed instances than a mass-exploitation priority. Note a data inconsistency: the description attributes the write primitive to an attacker-controlled 'database name' (--result-file example), while the referenced fix commits validate the 'dump_flags' input via a new SafeDumpFlags rule - verify the exact injectable parameter against the vendor advisory.

An authenticated low-privilege user of a Databasement instance configures a database backup and injects a dump argument such as --result-file=/app/public/index.php (argument injection into mariadb-dump); because the file lands in the web-accessible directory, the attacker then requests it to execute attacker-supplied PHP, achieving remote code execution. Shell quoting does not help because the option is interpreted by the dump client, not the shell. A public proof-of-concept/advisory exists, so the technique is documented and reproducible.