CVE-2026-75842: ArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSV
ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server process privileges, exfiltrating sensitive data directly in query responses.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ArcadeDBto a version that resolves this vulnerability.Fixed in 26.8.1 - Compensating control
Restrict/limit who has read query privileges so only fully trusted authenticated users can execute OpenCypher queries that include the LOAD CSV FROM clause (to prevent use of the file:// protocol for arbitrary file reads).
Event History
Frequently Asked Questions
Which deployments and users are exposed?
ArcadeDB deployments running versions before 26.8.1 are affected when authenticated users have read query privileges. The exposed files are those readable by the ArcadeDB server process, rather than only files owned by the querying user.
What access is required to exploit this issue?
An attacker needs valid authentication and read query privileges, but does not need user interaction. They can issue OpenCypher LOAD CSV statements using the file:// protocol and receive file contents in query responses.
What remediation is identified?
Upgrade ArcadeDB to version 26.8.1 or later. The provided information does not identify an alternative mitigation for environments where upgrading cannot occur immediately.