CyberRota Analysis
AI-GeneratedArcadeDB versions prior to 26.8.1 are vulnerable to an arbitrary file read issue within the OpenCypher LOAD CSV FROM clause, allowing authenticated users to exploit the file:// protocol to access local files. This vulnerability can lead to the exfiltration of sensitive data, as attackers with read query privileges can retrieve files with the same permissions as the server process. Organizations using affected versions should prioritize patching to mitigate the risk of data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server process privileges, exfiltrating sensitive data directly in query responses.