Skip to content
CVE PROGRAM SOURCE RECORD8.3 High

CVE-2026-75842

ArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSV

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server process privileges, exfiltrating sensitive data directly in query responses.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ArcadeData arcadedb

Default version status: unaffected

  • 0 to < 26.8.1affected
  • 26.8.1unaffected
pkg:maven/com.arcadedb/arcadedb-engine

References