CVE-2026-75842 in ArcadeDB
Summary
by MITRE • 08/18/2026
ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server process privileges, exfiltrating sensitive data directly in query responses.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
ArcadeDB versions prior to 26.8.1 are susceptible to an Arbitrary File Read vulnerability within the OpenCypher implementation of the LOAD CSV FROM clause. This security flaw stems from insufficient validation and sanitization of file path inputs provided by authenticated users executing graph queries. The vulnerability specifically targets the mechanism designed for importing external data into the database, which traditionally allows loading comma-separated values from remote or local sources to facilitate complex data integration workflows. In this context, the system fails to restrict access solely to intended network resources or whitelisted directories, thereby exposing a critical attack vector that bypasses standard application-level security controls.
The technical root cause lies in the handling of the file:// protocol scheme within LOAD CSV statements. When an authenticated user with read query privileges constructs a malicious query specifying a local file path using this protocol, the database engine processes it without adequate boundary checks or permission validations relative to the operating system's access control lists. Consequently, the server process executes the file read operation under its own elevated privileges rather than restricting access to the permissions of the initiating user session. This architectural oversight allows an attacker to traverse directory structures and access sensitive files residing on the host machine where ArcadeDB is deployed, effectively treating local storage as if it were a publicly accessible resource within the database context.
The operational impact of this vulnerability is severe, particularly in environments where the database service runs with high-level system privileges or accesses critical configuration files, credentials, or proprietary data stores. An attacker can exfiltrate sensitive information directly through query responses, leveraging the database as an out-of-band channel for data theft. This capability compromises the confidentiality and integrity of the entire infrastructure hosting the database instance. Furthermore, because the exploitation requires only authenticated access with read privileges, which is often granted to application users or analysts, the attack surface is significantly broadened compared to vulnerabilities requiring administrative rights. The ability to read arbitrary files can serve as a stepping stone for further attacks, such as privilege escalation if sensitive configuration data reveals additional credentials or system details are exposed.
To mitigate this risk, organizations running ArcadeDB versions before 26.8.1 must upgrade immediately to version 26.8.1 or later, where the developers have implemented stricter input validation and restricted the file:// protocol usage to prevent arbitrary local file access. In environments where upgrading is not immediately feasible, administrators should enforce strict network segmentation to limit database server outbound connections and restrict inbound query capabilities to only those users who absolutely require CSV import functionality. Additionally, running the ArcadeDB service with minimal necessary privileges using principles of least privilege can reduce the impact if an exploitation attempt occurs by limiting the scope of files accessible via the operating system's permission model. Regular auditing of user permissions and monitoring for anomalous database queries involving file protocols are also recommended defensive measures to detect potential abuse attempts early in the kill chain.
This vulnerability aligns with CWE-284, which describes Improper Access Control, as it involves a failure to enforce proper restrictions on authenticated users regarding resource access. It is further categorized under CWE-732, concerning Incorrect Permission Assignment for Critical Resource, due to the elevation of file read operations beyond the user's intended scope. From an offensive security perspective, this technique corresponds to ATT&CK T1083, File and Directory Discovery, as it enables attackers to enumerate and access local files on a compromised system through database query manipulation rather than direct shell access or network scanning tools.