CVE-2025-71394CWE-22path-traversal

CVE-2025-71394

Medium · published July 18, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
29.4
In the wild
Unconfirmed
What it is

SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows authenticated users to read arbitrary files on the file system. Attackers with root, namespace, or database level privileges can point analyzers to arbitrary file paths and exfiltrate content from two-column tab-separated files.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00367 · 29.4th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-07-18T18:17Z
Affected products (2)
ProductVersionsFixed in
surrealdb/surrealdb< 2.1.52.1.5
surrealdb/surrealdb≥ 2.2.0, < 2.2.22.2.2
References (2)
https://github.com/surrealdb/surrealdb/security/advisories/GHSA-2cvj-g5r5-jrrg · [email protected]https://www.vulncheck.com/advisories/surrealdb-before-local-file-read-via-define-analyzer · [email protected]
EPSS history
Timeline
  • 18 JUL 13:10Z
    SurrealDB before 2.2.2 Local File Read via DEFINE ANALYZER
    cvelistv5