Skip to content
OpenAdvisories

Package · Maven

com.arcadedb:arcadedb-engine

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • High 7.1
    CVE-2026-54077

    ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users

    ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not require administrative privileges and passed its source to integration/src/main/java/com/…

    ArcadeData com.arcadedb arcadedb arcadedb-engine Maven
  • High 8.1
    CVE-2026-54076

    ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)

    ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATE_SCHEMA authorization check only to LocalDocumentType.createProperty, while the remaining public schema mutators in engine/src/main/java/com/arcadedb/schema/LocalDocume…

    ArcadeData com.arcadedb arcadedb arcadedb-engine Maven
  • High 7.2
    CVE-2026-67340 Public exploit

    ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts

    ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java.lang.* to the allowed packages. An authenticated user with UPDATE_SCHEMA permission can create a Jav…

    ArcadeData arcadedb com.arcadedb:arcadedb-engine Maven
  • Critical 9.8
    CVE-2026-67341

    ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTION

    ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing secu…

    ArcadeData arcadedb com.arcadedb:arcadedb-engine Maven