CVE-2026-63663

CloudBeaver is a cloud database manager. From version 23.2.3 until 26.1.2, a path traversal vulnerability in its SQL result-editing functionality allows an authenticated user with SQL result-editing privileges to cause the server to open files outside the intended temporary upload directory. In affected database value-handling scenarios, this can disclose local files readable by the CloudBeaver server process. Version 26.1.2 prevents traversal outside the intended temporary upload directory.

• CWE-22

• https://github.com/dbeaver/cloudbeaver/commit/caef729a8d227b0446eab6f0ae5f1dc20dced9b5
• https://github.com/dbeaver/cloudbeaver/pull/4411
• https://github.com/dbeaver/cloudbeaver/security/advisories/GHSA-8wr4-mh28-m992

Published

Nov 6, 2026

Last Modified

Nov 6, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6365Improper Neutralization of Input During Web Page Generation …6.1
• CVE-2026-63650OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote…2
• CVE-2026-63652FreeRDP is a free implementation of the Remote Desktop Proto…6.5
• CVE-2026-63654Frappe is a full-stack web application framework. In version…6.9
• CVE-2026-63655tsParticles is a TypeScript library for creating highly cust…7.5
• CVE-2026-6366Improperly Controlled Modification of Dynamically-Determined…6.6
• CVE-2026-63664CloudBeaver is a cloud database manager. In versions up to a…6.5
• CVE-2026-63667ApostropheCMS is an open-source Node.js content management s…6.5
• CVE-2026-63669ApostropheCMS is an open-source Node.js content management s…6.5
• CVE-2026-6367Improper Neutralization of Input During Web Page Generation …6.1
• CVE-2026-63670ApostropheCMS is an open-source Node.js content management s…6.1
• CVE-2026-63671MDC is a tool to take regular Markdown and write documents i…8.1