CVE-2026-75842
ArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSV
- State
- Published
- Severity
- 8.3 High
- Published
- Aug 18, 2026
- Updated
- Aug 19, 2026
- Reserved
- Aug 18, 2026
Description
ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server process privileges, exfiltrating sensitive data directly in query responses.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.3 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N | VulnCheck |
| 3.1 | 7.7 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
arcadedbArcadeData |
|
References
- GitHub Security Advisory (GHSA-hfp5-6gcp-8c75)vendor-advisory
- VulnCheck Advisory: ArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSVthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.