CVE-2026-92186High· 8.8▾ Abyssal0dayQuest Foglight for Databases paFnUploadFileAndCreateInfo Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databa…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 48.4 · likelihood 0.3 · exploitation 25
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
1.3%
Quest Foglight for Databases paFnUploadFileAndCreateInfo Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability.
The specific flaw exists within the paFnUploadFileAndCreateInfo script. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29038.
foglight_for_databases 8.2.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-92197High· 8.8Quest Foglight for Databases unzipFile Directory Traversal Remote Code Execution Vulnerability
CVE-2026-92192High· 8.8Quest Foglight for Databases installLicense Directory Traversal Remote Code Execution Vulnerability
CVE-2026-92195High· 8.8Quest Foglight for Databases loadEvolveLicense Directory Traversal Remote Code Execution Vulnerability
CVE-2026-92194High· 8.8Quest Foglight for Databases loadManageServerLicense Directory Traversal Remote Code Execution Vulnerability
CVE-2026-92187High· 8.8Quest Foglight for Databases extractAndCreateUploadInfoList Directory Traversal Remote Code Execution Vulnerability
CVE-2026-92196High· 7.2Quest Foglight for Databases renderTemplateString Server-Side Template Injection Remote Code Execution Vulnerability