CVE-2026-54077 in ArcadeDB
Summary
by MITRE • 09/15/2026
ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not require administrative privileges and passed its source to integration/src/main/java/com/arcadedb/integration/importer/SourceDiscovery.java without validation. An authenticated user with SQL command access through /api/v1/command or /api/v1/query can supply HTTP or HTTPS destinations to make server-side requests to internal services, or file:// paths to read files accessible to the server process and ingest the results as queryable records. The XML importer also permits DTD processing and external entities, enabling entity expansion. The root-only /api/v1/server administration endpoint is not affected. The fix requires updateSecurity permission, blocks local-network import destinations by default through arcadedb.server.security.importBlockLocalNetworks, supports the arcadedb.server.security.importAllowedLocalPaths file allow-list, and disables XML DTD processing and external entities. This issue is fixed in version 26.6.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in ArcadeDB prior to version 26.6.1 represents a critical server-side request forgery and arbitrary file read flaw stemming from insufficient access control validation within the database import functionality. Specifically, the IMPORT DATABASE SQL statement located in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java failed to enforce administrative privilege requirements for operations that could significantly impact system security or data integrity. This design oversight allowed any authenticated user possessing basic SQL command execution privileges through the /api/v1/command or /api/v1/query endpoints to execute import statements without verifying whether they held the necessary elevated permissions, such as updateSecurity. The core technical flaw lies in the lack of input validation and destination restriction when passing source parameters to integration/src/main/java/com/arcadedb/integration/importer/SourceDiscovery.java. By accepting unvalidated inputs, the system permitted attackers to specify arbitrary sources for database ingestion, which the server would then process without adequate scrutiny regarding the origin or nature of that data.
The operational impact of this vulnerability is severe due to its dual capability to facilitate both network-based attacks and local file system compromise. An attacker can supply HTTP or HTTPS URLs as import destinations, effectively forcing the ArcadeDB server to make outbound requests to internal services or external malicious hosts. This behavior mirrors Server-Side Request Forgery patterns where the database engine acts as a proxy for unauthorized network access, potentially allowing attackers to scan internal networks, exfiltrate data from unprotected internal APIs, or interact with sensitive backend infrastructure that is not directly exposed to the public internet. Furthermore, by specifying file:// URIs pointing to local paths accessible to the server process, an authenticated user can read arbitrary files from the underlying operating system and ingest their contents as queryable records within the database. This capability effectively bypasses standard filesystem permissions relative to the application user context, leading to unauthorized disclosure of sensitive configuration files, credentials, or other private data stored on the host machine.
In addition to direct file reading and network request forgery, the vulnerability extends into XML processing risks through the integration with an XML importer that permits Document Type Definition processing and external entity expansion. This feature enables Entity Expansion attacks, commonly known as XML bombs, where a small input can trigger exponential resource consumption during parsing, leading to denial of service conditions by exhausting CPU or memory resources on the server. The combination of unrestricted file access via file:// paths and uncontrolled DTD processing creates a multifaceted attack surface that compromises confidentiality, integrity, and availability. It is important to note that this vulnerability does not affect the root-only /api/v1/server administration endpoint, indicating that the flaw is specifically tied to lower-privilege SQL execution channels rather than high-level administrative controls.
To mitigate these risks, ArcadeDB version 26.6.1 implements several robust security enhancements designed to close these attack vectors. The primary fix involves enforcing strict permission checks by requiring the updateSecurity privilege for any import operations, thereby ensuring that only authorized administrators can execute database imports. Additionally, the software introduces a default block on local-network import destinations through the configuration parameter arcadedb.server.security.importBlockLocalNetworks, which prevents the server from making requests to internal IP ranges unless explicitly allowed. For scenarios where legitimate access to specific local files is required, an allow-list mechanism via arcadedb.server.security.importAllowedPaths provides granular control over permitted file paths, ensuring that only designated directories can be accessed during import operations. Finally, XML DTD processing and external entity resolution are disabled by default in the patched version, eliminating the risk of entity expansion attacks while maintaining security against maliciously crafted XML inputs. Organizations running versions prior to 26.6.1 should upgrade immediately and review their network segmentation strategies to limit potential lateral movement if exploitation has occurred.