AIKIDO-2026-305442

TL;DR

The sql-log plugin builds its log file path from the ns request parameter and appends it without sanitization. The value is normally validated as a schema name, but that check is skipped when no database is selected, leaving the path fully controlled by the request. An authenticated user connecting with their own database server can write .sql files to any directory writable by the process, enabling traversal outside the web root. The fix validates the schema input before it is used in the log path.