Description

ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server process privileges, exfiltrating sensitive data directly in query responses.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-18T12:19:34.597Z",
  "pubdate": "2026-08-18T12:19:34.597Z",
  "executiveSummary": "ArcadeDB versions prior to 26.8.1 suffer from an arbitrary file read vulnerability located within the OpenCypher LOAD CSV FROM clause. This security flaw enables authenticated users possessing read query privileges to exploit the server by utilizing the file:// protocol within LOAD CSV statements. Consequently, attackers can successfully access arbitrary local files running under the security context and privileges of the server process, leading to the direct exfiltration of sensitive system data embedded within query responses. The risk implications include unauthorized disclosure of confidential files accessible to the application runtime, potentially compromising underlying host system integrity. Exploitation requires valid authentication, specifically read query privileges, allowing malicious actors to leverage database query interfaces to bypass intended file access boundaries and retrieve unauthorized system data.",
  "technicalDetails": "The vulnerability resides in the OpenCypher query processing component of ArcadeDB, specifically within the implementation of the LOAD CSV FROM clause. The root cause stems from insufficient input validation and sanitization regarding URI schemes permitted within data loading operations. When parsing OpenCypher queries containing a LOAD CSV FROM statement, the application fails to restrict or disable the file:// protocol, allowing direct interaction with the underlying host filesystem.\nTo execute an attack, an authenticated user with read query privileges crafts a malicious OpenCypher query incorporating the file:// protocol directed at a target file path on the server filesystem. Upon query execution, the vulnerable component processes the LOAD CSV instruction, invokes file retrieval routines with the operating system privileges of the server process, and reads the contents of the specified file. The parsed or raw file data is subsequently returned directly within the database query response payload, enabling successful data exfiltration.\nThe attack vector requires network exposure to the ArcadeDB query interface, valid authentication credentials, and permissions to execute read queries. The vulnerable component is the OpenCypher query engine handling CSV data ingestion across ArcadeDB versions before 26.8.1. Post-exploitation impact is characterized by the unauthorized retrieval of sensitive configuration files, source code, credentials, or other system assets accessible to the user account executing the server daemon."
}