ArcadeDB before version 26.8.1 does not sanitize database names in the create and drop database commands, allowing an authenticated root user to write or delete files outside the configured database directory. This flaw enables an attacker to place or remove arbitrary files on the server, potentially leading to arbitrary code execution or denial of service. The weakness is categorized as a path traversal (CWE‑22).

ArcadeData ArcadeDB before version 26.8.1 is affected, with versions prior to 26.8.1 lacking the fix for the create/drop database path sanitization. Users of those versions who authenticate as root or possess root-level database administration permissions are susceptible.

The vulnerability carries a CVSS score of 8.4, indicating high severity. EPSS data is not available, and the issue is not listed in CISA KEV. Attackers must have authenticated root or equivalent privileges to exploit the flaw, and they can supply database names with '../' sequences to traverse the filesystem. Given the high impact score and the need for elevated privileges, the risk is significant for environments where the database server runs with root or similar permissions.