Skip to content
OpenAdvisories

Package · Maven

com.arcadedb:arcadedb-engine

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.1
    CVE-2026-54077

    ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users

    ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not require administrative privileges and passed its source to integration/src/main/java/com/…

    ArcadeData com.arcadedb arcadedb arcadedb-engine Maven
  • High 8.1
    CVE-2026-54076

    ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)

    ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATE_SCHEMA authorization check only to LocalDocumentType.createProperty, while the remaining public schema mutators in engine/src/main/java/com/arcadedb/schema/LocalDocume…

    ArcadeData com.arcadedb arcadedb arcadedb-engine Maven
  • High 7.2
    CVE-2026-67340 Public exploit

    ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts

    ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java.lang.* to the allowed packages. An authenticated user with UPDATE_SCHEMA permission can create a Jav…

    ArcadeData arcadedb com.arcadedb:arcadedb-engine Maven