Skip to content
OpenAdvisories

Product · com.arcadedb

arcadedb-engine

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.1
    CVE-2026-54077

    ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users

    ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not require administrative privileges and passed its source to integration/src/main/java/com/…

    ArcadeData com.arcadedb arcadedb arcadedb-engine Maven
  • High 8.1
    CVE-2026-54076

    ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)

    ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATE_SCHEMA authorization check only to LocalDocumentType.createProperty, while the remaining public schema mutators in engine/src/main/java/com/arcadedb/schema/LocalDocume…

    ArcadeData com.arcadedb arcadedb arcadedb-engine Maven