Vulnerability-Lookup

CVE-2026-54077 (GCVE-0-2026-54077)

Vulnerability from cvelistv5 – Published: 2026-09-15 15:17 – Updated: 2026-09-15 15:44

Title

ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users

Summary

ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not require administrative privileges and passed its source to integration/src/main/java/com/arcadedb/integration/importer/SourceDiscovery.java without validation. An authenticated user with SQL command access through /api/v1/command or /api/v1/query can supply HTTP or HTTPS destinations to make server-side requests to internal services, or file:// paths to read files accessible to the server process and ingest the results as queryable records. The XML importer also permits DTD processing and external entities, enabling entity expansion. The root-only /api/v1/server administration endpoint is not affected. The fix requires updateSecurity permission, blocks local-network import destinations by default through arcadedb.server.security.importBlockLocalNetworks, supports the arcadedb.server.security.importAllowedLocalPaths file allow-list, and disables XML DTD processing and external entities. This issue is fixed in version 26.6.1.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 15:44 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/ArcadeData/arcadedb/security/a…	x_refsource_CONFIRM
https://github.com/ArcadeData/arcadedb/pull/4422	x_refsource_MISC
https://github.com/ArcadeData/arcadedb/commit/bdc…	x_refsource_MISC
https://github.com/ArcadeData/arcadedb/releases/t…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version	CPE status
ArcadeData	arcadedb	Affected: < 26.6.1	guessed
com.arcadedb	arcadedb-engine	Affected: < 26.6.1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54077",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T15:44:01.515219Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T15:44:11.572Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "arcadedb",
          "vendor": "ArcadeData",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 26.6.1"
            }
          ]
        },
        {
          "product": "arcadedb-engine",
          "vendor": "com.arcadedb",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 26.6.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not require administrative privileges and passed its source to integration/src/main/java/com/arcadedb/integration/importer/SourceDiscovery.java without validation. An authenticated user with SQL command access through /api/v1/command or /api/v1/query can supply HTTP or HTTPS destinations to make server-side requests to internal services, or file:// paths to read files accessible to the server process and ingest the results as queryable records. The XML importer also permits DTD processing and external entities, enabling entity expansion. The root-only /api/v1/server administration endpoint is not affected. The fix requires updateSecurity permission, blocks local-network import destinations by default through arcadedb.server.security.importBlockLocalNetworks, supports the arcadedb.server.security.importAllowedLocalPaths file allow-list, and disables XML DTD processing and external entities. This issue is fixed in version 26.6.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-776",
              "description": "CWE-776: Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T15:17:35.047Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-8w86-m9h8-hvqg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-8w86-m9h8-hvqg"
        },
        {
          "name": "https://github.com/ArcadeData/arcadedb/pull/4422",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ArcadeData/arcadedb/pull/4422"
        },
        {
          "name": "https://github.com/ArcadeData/arcadedb/commit/bdc414cbdeda094cf8c20637cdc937335a3a19ee",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ArcadeData/arcadedb/commit/bdc414cbdeda094cf8c20637cdc937335a3a19ee"
        },
        {
          "name": "https://github.com/ArcadeData/arcadedb/releases/tag/26.6.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ArcadeData/arcadedb/releases/tag/26.6.1"
        }
      ],
      "source": {
        "advisory": "GHSA-8w86-m9h8-hvqg",
        "discovery": "UNKNOWN"
      },
      "title": "ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54077",
    "datePublished": "2026-09-15T15:17:35.047Z",
    "dateReserved": "2026-06-11T18:44:47.760Z",
    "dateUpdated": "2026-09-15T15:44:11.572Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-54077",
      "date": "2026-09-20",
      "epss": "0.00374",
      "percentile": "0.3125"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "arcadedb",
                "vendor": "ArcadeData",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 26.6.1"
                  }
                ]
              },
              {
                "product": "arcadedb-engine",
                "vendor": "com.arcadedb",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 26.6.1"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not require administrative privileges and passed its source to integration/src/main/java/com/arcadedb/integration/importer/SourceDiscovery.java without validation. An authenticated user with SQL command access through /api/v1/command or /api/v1/query can supply HTTP or HTTPS destinations to make server-side requests to internal services, or file:// paths to read files accessible to the server process and ingest the results as queryable records. The XML importer also permits DTD processing and external entities, enabling entity expansion. The root-only /api/v1/server administration endpoint is not affected. The fix requires updateSecurity permission, blocks local-network import destinations by default through arcadedb.server.security.importBlockLocalNetworks, supports the arcadedb.server.security.importAllowedLocalPaths file allow-list, and disables XML DTD processing and external entities. This issue is fixed in version 26.6.1."
          }
        ],
        "id": "CVE-2026-54077",
        "lastModified": "2026-09-15T16:17:13.710",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 4.2,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-54077",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T15:44:01.515219Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-15T16:17:13.710",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/ArcadeData/arcadedb/commit/bdc414cbdeda094cf8c20637cdc937335a3a19ee"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/ArcadeData/arcadedb/pull/4422"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/ArcadeData/arcadedb/releases/tag/26.6.1"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-8w86-m9h8-hvqg"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-22"
              },
              {
                "lang": "en",
                "value": "CWE-776"
              },
              {
                "lang": "en",
                "value": "CWE-918"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-54077",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-15T15:44:01.515219Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-15T15:44:06.616Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "arcadedb",
              "vendor": "ArcadeData",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 26.6.1"
                }
              ]
            },
            {
              "product": "arcadedb-engine",
              "vendor": "com.arcadedb",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 26.6.1"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not require administrative privileges and passed its source to integration/src/main/java/com/arcadedb/integration/importer/SourceDiscovery.java without validation. An authenticated user with SQL command access through /api/v1/command or /api/v1/query can supply HTTP or HTTPS destinations to make server-side requests to internal services, or file:// paths to read files accessible to the server process and ingest the results as queryable records. The XML importer also permits DTD processing and external entities, enabling entity expansion. The root-only /api/v1/server administration endpoint is not affected. The fix requires updateSecurity permission, blocks local-network import destinations by default through arcadedb.server.security.importBlockLocalNetworks, supports the arcadedb.server.security.importAllowedLocalPaths file allow-list, and disables XML DTD processing and external entities. This issue is fixed in version 26.6.1."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-22",
                  "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-776",
                  "description": "CWE-776: Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-918",
                  "description": "CWE-918: Server-Side Request Forgery (SSRF)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-15T15:17:35.047Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-8w86-m9h8-hvqg",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-8w86-m9h8-hvqg"
            },
            {
              "name": "https://github.com/ArcadeData/arcadedb/pull/4422",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/ArcadeData/arcadedb/pull/4422"
            },
            {
              "name": "https://github.com/ArcadeData/arcadedb/commit/bdc414cbdeda094cf8c20637cdc937335a3a19ee",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/ArcadeData/arcadedb/commit/bdc414cbdeda094cf8c20637cdc937335a3a19ee"
            },
            {
              "name": "https://github.com/ArcadeData/arcadedb/releases/tag/26.6.1",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/ArcadeData/arcadedb/releases/tag/26.6.1"
            }
          ],
          "source": {
            "advisory": "GHSA-8w86-m9h8-hvqg",
            "discovery": "UNKNOWN"
          },
          "title": "ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-54077",
        "datePublished": "2026-09-15T15:17:35.047Z",
        "dateReserved": "2026-06-11T18:44:47.760Z",
        "dateUpdated": "2026-09-15T15:44:11.572Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-54077

Vulnerability from fkie_nvd - Published: 2026-09-15 16:17 - Updated: 2026-09-15 16:17

Severity

7.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/ArcadeData/arcadedb/commit/bdc414cbdeda094cf8c20637cdc937335a3a19ee
	security-advisories@github.com	https://github.com/ArcadeData/arcadedb/pull/4422
	security-advisories@github.com	https://github.com/ArcadeData/arcadedb/releases/tag/26.6.1
	security-advisories@github.com	https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-8w86-m9h8-hvqg

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "arcadedb",
          "vendor": "ArcadeData",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 26.6.1"
            }
          ]
        },
        {
          "product": "arcadedb-engine",
          "vendor": "com.arcadedb",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 26.6.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not require administrative privileges and passed its source to integration/src/main/java/com/arcadedb/integration/importer/SourceDiscovery.java without validation. An authenticated user with SQL command access through /api/v1/command or /api/v1/query can supply HTTP or HTTPS destinations to make server-side requests to internal services, or file:// paths to read files accessible to the server process and ingest the results as queryable records. The XML importer also permits DTD processing and external entities, enabling entity expansion. The root-only /api/v1/server administration endpoint is not affected. The fix requires updateSecurity permission, blocks local-network import destinations by default through arcadedb.server.security.importBlockLocalNetworks, supports the arcadedb.server.security.importAllowedLocalPaths file allow-list, and disables XML DTD processing and external entities. This issue is fixed in version 26.6.1."
    }
  ],
  "id": "CVE-2026-54077",
  "lastModified": "2026-09-15T16:17:13.710",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54077",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-15T15:44:01.515219Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-15T16:17:13.710",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ArcadeData/arcadedb/commit/bdc414cbdeda094cf8c20637cdc937335a3a19ee"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ArcadeData/arcadedb/pull/4422"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ArcadeData/arcadedb/releases/tag/26.6.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-8w86-m9h8-hvqg"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-776"
        },
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-8W86-M9H8-HVQG

Vulnerability from github – Published: 2026-07-16 20:05 – Updated: 2026-07-16 20:05

Summary

ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users

Details

Impact

The SQL IMPORT DATABASE statement did not require administrative privileges and passed its source URL to the importer without validation. Any authenticated user with SQL command access (not only root/administrators) could therefore:

Server-Side Request Forgery (CWE-918): cause the server to issue HTTP(S) requests to arbitrary destinations, including cloud metadata endpoints (e.g. 169.254.169.254) and internal-only services, and ingest the responses as queryable records.
Arbitrary local file read (CWE-22): read local files reachable by the server process (e.g. /etc/passwd, credential files) by importing file:// paths, exposing their contents as records.

The server administration endpoint (/api/v1/server) was already restricted to the root user and was not affected; the exposure was through the database SQL command/query endpoints (/api/v1/command, /api/v1/query).

A related lower-severity hardening gap (CWE-776): the XML importer did not disable DTD processing, leaving entity-expansion (Billion Laughs) possible.

Affected component

integration/src/main/java/com/arcadedb/integration/importer/SourceDiscovery.java (no host allow-list for http(s); no path validation for file://), reached from engine/.../query/sql/parser/ImportDatabaseStatement.java.

Patches

IMPORT DATABASE now requires the administrative updateSecurity permission (no-op in embedded mode).
Import sources are validated in SourceDiscovery: HTTP(S) hosts resolving to loopback / link-local / private (site-local) / wildcard / multicast addresses are blocked by default (arcadedb.server.security.importBlockLocalNetworks, default true), and an optional local-path allow-list (arcadedb.server.security.importAllowedLocalPaths) restricts file:// reads.
The XML importer now disables DTD processing and external entities.

Fixed in commit referenced by pull request #4422.

Workarounds

Restrict SQL command/query access to trusted administrative users; do not grant query access to untrusted users on servers that can reach sensitive networks or hold sensitive local files. Upgrading is strongly recommended.

Credit

Reported by Bin Luo (luob87709@gmail.com).

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.arcadedb:arcadedb-engine"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "26.6.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54077"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-776",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-16T20:05:56Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\n\nThe SQL `IMPORT DATABASE` statement did not require administrative privileges and passed its source URL to the importer without validation. Any authenticated user with SQL command access (not only `root`/administrators) could therefore:\n\n- **Server-Side Request Forgery (CWE-918):** cause the server to issue HTTP(S) requests to arbitrary destinations, including cloud metadata endpoints (e.g. `169.254.169.254`) and internal-only services, and ingest the responses as queryable records.\n- **Arbitrary local file read (CWE-22):** read local files reachable by the server process (e.g. `/etc/passwd`, credential files) by importing `file://` paths, exposing their contents as records.\n\nThe server administration endpoint (`/api/v1/server`) was already restricted to the `root` user and was **not** affected; the exposure was through the database SQL command/query endpoints (`/api/v1/command`, `/api/v1/query`).\n\nA related lower-severity hardening gap (CWE-776): the XML importer did not disable DTD processing, leaving entity-expansion (Billion Laughs) possible.\n\n### Affected component\n\n`integration/src/main/java/com/arcadedb/integration/importer/SourceDiscovery.java` (no host allow-list for http(s); no path validation for `file://`), reached from `engine/.../query/sql/parser/ImportDatabaseStatement.java`.\n\n### Patches\n\n- `IMPORT DATABASE` now requires the administrative `updateSecurity` permission (no-op in embedded mode).\n- Import sources are validated in `SourceDiscovery`: HTTP(S) hosts resolving to loopback / link-local / private (site-local) / wildcard / multicast addresses are blocked by default (`arcadedb.server.security.importBlockLocalNetworks`, default `true`), and an optional local-path allow-list (`arcadedb.server.security.importAllowedLocalPaths`) restricts `file://` reads.\n- The XML importer now disables DTD processing and external entities.\n\nFixed in commit referenced by pull request [#4422](https://github.com/ArcadeData/arcadedb/pull/4422).\n\n### Workarounds\n\nRestrict SQL command/query access to trusted administrative users; do not grant query access to untrusted users on servers that can reach sensitive networks or hold sensitive local files. Upgrading is strongly recommended.\n\n### Credit\n\nReported by Bin Luo (luob87709@gmail.com).",
  "id": "GHSA-8w86-m9h8-hvqg",
  "modified": "2026-07-16T20:05:56Z",
  "published": "2026-07-16T20:05:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-8w86-m9h8-hvqg"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ArcadeData/arcadedb"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ArcadeData/arcadedb/releases/tag/26.6.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-54077 (GCVE-0-2026-54077)

FKIE_CVE-2026-54077

GHSA-8W86-M9H8-HVQG

Impact

Affected component

Patches

Workarounds

Credit

Tags

Sightings

Nomenclature

Related by attack behaviour