What is GHSA-7gx5-3cjh-4p7m?

GHSA-7gx5-3cjh-4p7m is a security advisory published by GitHub Security Advisories with High severity. Heimdall Data Database Proxy uploadJar Directory Traversal Remote Code Execution Vulnerability....

Which CVE IDs does GHSA-7gx5-3cjh-4p7m cover?

GHSA-7gx5-3cjh-4p7m covers the following CVE IDs: CVE-2026-18274. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7gx5-3cjh-4p7m?

GHSA-7gx5-3cjh-4p7m has a CVSS v3 base score of 7.2, published by GitHub Security Advisories.

GHSA-7gx5-3cjh-4p7mHighCVSS 7.2

Heimdall Data Database Proxy uploadJar Directory Traversal Remote Code Execution Vulnerability....

Vendor

GitHub Security Advisories

Published

August 20, 2026

Last Modified

August 20, 2026

🔗 CVE IDs covered (1)

CVE-2026-18274 →

📋 Description

Heimdall Data Database Proxy uploadJar Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Heimdall Data Database Proxy. Authentication is required to exploit this vulnerability.

The specific flaw exists within the uploadJar method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-28603.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-18274
https://www.zerodayinitiative.com/advisories/ZDI-26-479
https://github.com/advisories/GHSA-7gx5-3cjh-4p7m