CVE-2026-126293: NocoDB before 2026.06.2 Attachment Size Limit Bypass via Upload by URL
NocoDB before 2026.06.2 contains an attachment size limit bypass that allows authenticated Editor users to store oversized files because data-attachment-v3.service.ts trusts the remote server's advertised content length. Attackers can point the v3 upload-by-URL endpoint at a server that understates or omits its length to exhaust disk space or storage quota.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with the Editor role can exploit it. The attacker also needs to be able to supply a URL to a remote server that advertises an understated Content-Length value or omits it.
Is a default deployment affected?
The issue affects NocoDB versions before 2026.06.2 where Editor users can use the v3 upload-by-URL endpoint. Exploitation depends on an attacker being able to authenticate as an Editor and host or control a remote response used for the upload.
What is the impact of successful exploitation?
An attacker can store files larger than the configured attachment size limit. This can exhaust available disk space or storage quota, causing a denial of service.
What can be done if upgrading is not immediately possible?
Restrict access to Editor accounts and limit their ability to use upload-by-URL where possible. Monitor attachment storage consumption and investigate unexpectedly large uploads, particularly those originating from URL-based uploads.