CVE-2026-12357

HighCVSS 7.2

Published: 29/07/2026(UTC)Updated: 30/07/2026(UTC)Translated: 30/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.09%

62th percentile - higher than 62% of all known CVEs

Summary

Vulnerability in Heimdall Data Database Proxy in the generateFileContent function allows an authenticated remote attacker to execute arbitrary code via CRLF injection. The attacker can gain root privileges.

Risk Assessment

An authenticated attacker can take control of the database proxy server, leading to full data compromise.

Recommendation

Apply the patch from Heimdall Data for ZDI-CAN-29251.

Other vulnerabilities in Heimdall Data Database Proxy

CVE-2026-18274High
Vulnerability in Heimdall Data Database Proxy in the uploadJar method allows remote code execution via directory traversal. Lack of path validation before using it in file operations. Authentication is required.

Original NVD description (English source)

Heimdall Data Database Proxy generateFileContent CRLF Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Heimdall Data Database Proxy. Authentication is required to exploit this vulnerability. The specific flaw exists within the generateFileContent function. The issue results from the lack of proper neutralization of CRLF sequences. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29251.