PT-2026-27119

CVE-2026-4586

Publicado

2026-03-23

Atualizado

2026-03-23

Descrição por

CVSS 2.0

6.5

Média

MétricasAV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CodePhiliaX Chat2DB versions up to 0.3.7

Description A flaw exists in CodePhiliaX Chat2DB that allows for unrestricted file uploads. This issue is located within the Upload function of the JdbcDriverController.java file, specifically in the chat2db-server/chat2db-server-web/chat2db-server-web-api/src/main/java/ai/chat2db/server/web/api/controller/driver/ component, related to the JDBC Driver Upload. The attack can be initiated remotely. The exploit has been publicly released.

Recommendations Versions prior to 0.3.7 should be updated. As a temporary workaround, consider restricting access to the Upload function within the JdbcDriverController.java file until a patch is available.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Vuldb

Xcxr

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-284: Improper Access Control

CWE-434: Unrestricted Upload of File with Dangerous Type