CyberRota Analysis
AI-GeneratedSurrealDB versions prior to 2.2.2 are vulnerable to a local file read issue within the DEFINE ANALYZER statement, enabling authenticated users with elevated privileges to access arbitrary files on the system. This vulnerability can lead to unauthorized data exfiltration from sensitive two-column tab-separated files. Organizations using affected versions should prioritize patching to mitigate potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows authenticated users to read arbitrary files on the file system. Attackers with root, namespace, or database level privileges can point analyzers to arbitrary file paths and exfiltrate content from two-column tab-separated files.
Related CVEs
Other vulnerabilities affecting the same vendor(s)