PT-2026-27119 · Codephiliax · Chat2Db

Vuldb + 1 · Published 2026-03-23 · Updated 2026-03-23 · CVE-2026-4586

NVD

CVSS v2.0

6.5

Medium

AV:N/AC:L/Au:S/C:P/I:P/A:P

A vulnerability was found in CodePhiliaX Chat2DB up to 0.3.7. This affects the function Upload of the file chat2db-server/chat2db-server-web/chat2db-server-web-api/src/main/java/ai/chat2db/server/web/api/controller/driver/JdbcDriverController.java of the component JDBC Driver Upload. Performing a manipulation results in unrestricted upload. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Exploit

Fix

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-434

Related Identifiers

CVE-2026-4586

Affected Products

Chat2Db

References · 5

• 🔥 https://fx4tqqfvdw4.feishu.cn/docx/PgtzdpfoWoTR0yxB7P6cujGanih?from=from_copylink · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4586 · Security Note
• https://vuldb.com/?ctiid.352432 · Note
• https://vuldb.com/?submit.775596 · Note
• https://vuldb.com/?id.352432 · Note