ZDI 2026-11-03

ZDI-26-853: Quest Foglight for Databases FileServlet External Control of File Path Information Disclosure Vulnerability

CVE-2026-92193

Machine-generated analysis · WAYSCloud LLM

The advisory notes that the FileServlet component can be externally controlled to disclose file paths.

Context

Quest Foglight for Databases includes a FileServlet component. The advisory describes an external control of file path condition that leads to information disclosure. Authentication is required to exploit the issue.

Operator considerations

Check: inventory Quest Foglight for Databases installations and verify the presence of the vulnerable FileServlet.
Isolate: restrict network access to the FileServlet endpoint if feasible.
Log: record requests to FileServlet and monitor for unexpected file path parameters.

From Zero Day Initiative ↗

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.5. The following CVEs are assigned: CVE-2026-92193.

Read the full advisory on ZDI →