PT-2026-27119 · Codephiliax · Codephiliax Chat2Db

Vuldb + 1 · Published 2026-03-23 · Updated 2026-03-23 · CVE-2026-4586

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CodePhiliaX Chat2DB versions up to 0.3.7

Description A flaw exists in CodePhiliaX Chat2DB that allows for unrestricted file uploads. This issue is located within the Upload function of the JdbcDriverController.java file, specifically in the chat2db-server/chat2db-server-web/chat2db-server-web-api/src/main/java/ai/chat2db/server/web/api/controller/driver/ component, related to the JDBC Driver Upload. The attack can be initiated remotely. The exploit has been publicly released.

Recommendations Versions prior to 0.3.7 should be updated. As a temporary workaround, consider restricting access to the Upload function within the JdbcDriverController.java file until a patch is available.

Exploit

Fix

Unrestricted File Upload

Improper Access Control

Weakness Enumeration

CWE-434

CWE-284

Related Identifiers

CVE-2026-4586

Affected Products

Codephiliax Chat2Db

References · 6

• 🔥 https://fx4tqqfvdw4.feishu.cn/docx/PgtzdpfoWoTR0yxB7P6cujGanih?from=from_copylink · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4586 · Security Note
• https://twitter.com/VulmonFeeds/status/2036124543073268011 · Twitter Post
• https://vuldb.com/?ctiid.352432 · Note
• https://vuldb.com/?id.352432 · Note
• https://vuldb.com/?submit.775596 · Note