CVE-2025-71394

SurrealDB before 2.2.2 Local File Read via DEFINE ANALYZER

State: Published
Severity: 2.3 Low
Published: Jul 18, 2026
Updated: Oct 29, 2026
Reserved: Jul 16, 2026

Description

SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows authenticated users to read arbitrary files on the file system. Attackers with root, namespace, or database level privileges can point analyzers to arbitrary file paths and exfiltrate content from two-column tab-separated files.

Scores

CVSS	Score	Vector	Source
4.0	2.3 Low	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	VulnCheck

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
surrealdbsurrealdb	2.2.0 to before 2.2.2Affected 2.2.2Not affected
surrealdbsurrealdb	before 2.1.5Affected 2.1.5Not affected

References

GitHub Security Advisory (GHSA-2cvj-g5r5-jrrg)vendor-advisory
VulnCheck Advisory: SurrealDB before 2.2.2 Local File Read via DEFINE ANALYZERthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.