CVE-2026-75840: ArcadeDB before 26.8.1 Arbitrary File Read via Unescaped Regex
ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforcement, which uses unescaped regular expressions to validate package names. Attackers with trigger creation privileges can use Java.type() to access java.util.zip.ZipFile or java.util.jar.JarFile classes and read arbitrary files on the host system as the ArcadeDB server process.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this vulnerability?
ArcadeDB instances before 26.8.1 are affected when an attacker has privileges to create triggers. The issue is remotely exploitable and does not require user interaction.
What access does an attacker need to exploit it?
An attacker needs trigger creation privileges and can then use Java.type() to reach java.util.zip.ZipFile or java.util.jar.JarFile despite the intended GraalVM JavaScript sandbox allowlist. This can be used to read arbitrary files accessible to the ArcadeDB server process.
What should be done if immediate patching is not possible?
Upgrade ArcadeDB to version 26.8.1 or later. If upgrading cannot happen immediately, restrict trigger creation privileges to trusted administrators because trigger creation is the stated prerequisite for exploitation.