CVE-2026-75842CWE-22path-traversal

CVE-2026-75842

High · published August 18, 2026

CVSS v3.1
7.7
EPSS
0%
Percentile
38.9
In the wild
Unconfirmed
What it is

ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server process privileges, exfiltrating sensitive data directly in query responses.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
8.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00460 · 38.9th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-08-18T16:19Z
References (3)
https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-hfp5-6gcp-8c75 · [email protected]https://www.vulncheck.com/advisories/arcadedb-before-arbitrary-file-read-via-load-csv · [email protected]https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-hfp5-6gcp-8c75 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 18 AUG 11:19Z
    ArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSV
    cvelistv5