Description

ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not require administrative privileges and passed its source to integration/src/main/java/com/arcadedb/integration/importer/SourceDiscovery.java without validation. An authenticated user with SQL command access through /api/v1/command or /api/v1/query can supply HTTP or HTTPS destinations to make server-side requests to internal services, or file:// paths to read files accessible to the server process and ingest the results as queryable records. The XML importer also permits DTD processing and external entities, enabling entity expansion. The root-only /api/v1/server administration endpoint is not affected. The fix requires updateSecurity permission, blocks local-network import destinations by default through arcadedb.server.security.importBlockLocalNetworks, supports the arcadedb.server.security.importAllowedLocalPaths file allow-list, and disables XML DTD processing and external entities. This issue is fixed in version 26.6.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-15T16:17:13.710Z",
  "pubdate": "2026-09-15T16:17:13.710Z",
  "executiveSummary": "ArcadeDB versions prior to 26.6.1 are vulnerable to Server-Side Request Forgery (SSRF) and arbitrary file read vulnerabilities.\nThe vulnerability originates from the improper validation of input parameters within the IMPORT DATABASE SQL statement, which is accessible to authenticated users with SQL command access.\nAttackers can leverage this flaw to conduct unauthorized requests against internal network services or access sensitive files on the host filesystem with the privileges of the server process.\nAdditionally, the integration of an XML importer with insecure DTD processing allows for XML External Entity (XXE) attacks, facilitating entity expansion.\nThe impact is significant, as it permits lateral movement within a network, data exfiltration, and potential information disclosure.\nExploitation requires a valid user account with SQL command execution privileges via the /api/v1/command or /api/v1/query endpoints.\nRisk is mitigated by upgrading to version 26.6.1, which introduces mandatory administrative privilege checks, input validation, network egress filtering, and secure XML processing configurations.",
  "technicalDetails": "The root cause of the vulnerability lies in the engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java file, which fails to enforce administrative privilege requirements for the IMPORT DATABASE operation. Consequently, the user-supplied input is passed directly to the integration/src/main/java/com/arcadedb/integration/importer/SourceDiscovery.java module without appropriate sanitization or validation.\nAuthenticated users, even without administrative roles, can execute SQL queries that invoke the import functionality. By providing malicious URIs, an attacker can manipulate the SourceDiscovery mechanism to perform SSRF. For HTTP/HTTPS requests, the server acts as a proxy, allowing the attacker to probe internal services and network segments that are not otherwise exposed to the public internet.\nFurthermore, the use of the file:// protocol prefix allows an attacker to direct the server to read arbitrary files accessible to the underlying operating system process. The ingested content is then processed and stored as queryable records within the database, effectively exfiltrating file contents via SQL query results.\nIn addition to file and network access, the XML importer component was found to be insecurely configured. It permits DTD processing and the resolution of external entities. This allows for XXE exploitation, where an attacker can supply specially crafted XML documents to force the parser to perform unauthorized actions, such as retrieving local files or conducting further SSRF attacks through entity expansion.\nThe attack flow proceeds as follows: 1) The attacker authenticates to the target ArcadeDB instance. 2) The attacker issues a command via /api/v1/command or /api/v1/query, invoking the IMPORT DATABASE statement. 3) The malicious input is processed by the unvalidated parser. 4) The server attempts to resolve the URI/file path or parse the XML content, performing the requested action with its own security context. 5) The attacker retrieves the resulting data through subsequent query execution or uses the server as a pivot for network scanning. This flaw bypasses security boundaries because it does not utilize the more robust, protected /api/v1/server administration endpoint for sensitive import operations."
}