CloudBeaver’s resource-management module resolves project identifiers without sanitizing the path segments. An authenticated user with resource-management privileges can craft a project identifier that causes the system to escape the shared-projects directory and enumerate directory names elsewhere on the server. This flaw allows disclosure of filesystem layout information; however, the vulnerability does not confirm the ability to read, write, or delete arbitrary files. The impact is limited to confidentiality (information disclosure) but it can aid further attacks by revealing sensitive server structure.

All deployments of CloudBeaver prior to version 26.1.2, which includes the dbeaver:cloudbeaver product. The flaw exists in the Resource Manager getProjectPath function within the core code base and is present in all affected releases before the 26.1.2 patch. Administrators should verify the version of CloudBeaver they are running and determine whether they are below the fixed release.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, suggesting a lower observed exploitation likelihood. The likely attack vector requires an authenticated user with resource-management privileges; the attacker must first compromise credentials or gain an existing user’s authorization. Once authenticated, the attacker can enumerate directory names outside the shared-projects sandbox, revealing filesystem layout information that could aid other attacks.