A path traversal flaw in CloudBeaver’s SQL result‑editing feature allows an authenticated user with result‑editing privileges to request the server to open files outside the intended temporary upload directory. The server can read local files that are readable by the CloudBeaver process, potentially exposing sensitive data. The vulnerability does not grant arbitrary code execution, but it permits information disclosure through file contents. The flaw is rooted in a directory traversal weakness (CWE-22).

The affected product is dBeaver CloudBeaver. Versions from 23.2.3 through 26.1.2 are vulnerable, while version 26.1.2 and later contain a fix that restricts traversal to the temporary upload directory.

The CVSS score of 6.5 indicates a moderate impact. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting it has not yet been widely exploited. An attacker who authenticates and has SQL result‑editing rights can exploit the flaw by submitting a crafted path during result editing, causing the server to read a file outside the intended directory. The requirement for elevated privileges limits the attack surface but still poses a real risk of local file disclosure.