Path Traversal in ArcadeDB Database Name Sanitization

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names containing ../ sequences to create databases at arbitrary filesystem paths or recursively delete directories the server process can access.

Casky was already ahead

This CVE exploits attack patterns that Casky's 351matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

ArcadeDB versions before 26.8.1 contain a critical path traversal vulnerability (CWE-22) in the POST /api/v1/server endpoint that fails to properly sanitize database names during create and drop database operations. Authenticated root users can exploit this flaw by injecting directory traversal sequences (../) into database names, enabling arbitrary file write and delete operations outside the configured database directory. This affects organizations running vulnerable ArcadeDB instances, particularly those exposing the API to authenticated users with elevated privileges. The vulnerability is especially dangerous because it allows attackers to write malicious files or delete critical system directories that the server process has access to, potentially leading to data destruction, application compromise, or lateral movement within the infrastructure.

Casky's 351 mapped security skills leverage Claude AI with extended reasoning to detect the adversarial techniques underlying this attack pattern. The vulnerability aligns with MITRE ATT&CK's Initial Access (TA0001) and Discovery (TA0007) tactics—attackers probe for unpatched ArcadeDB instances and enumerate filesystem permissions available to the service account. Practitioners using Casky would observe detections for suspicious POST requests to /api/v1/server endpoints containing path traversal payloads in database name parameters, unusual filesystem write operations to directories outside expected database paths, and recursive deletion patterns targeting parent directories. The platform's skills would flag authentication logs showing root-level API calls combined with filesystem access anomalies, helping security teams identify exploitation attempts before arbitrary files are written or critical data is destroyed.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

351 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-75855.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2026-75855

Casky has 351 skills that investigate the attack patterns behind CVE-2026-75855. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn