Skip to content
OpenAdvisories

Product · com.arcadedb

arcadedb-server

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.7
    CVE-2026-65831

    ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read

    ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-role user can submit POST /api/v1/command/{database} with language: js because PolyglotQueryEngine.command, PolyglotQueryEngine.analyze, and PolyglotQueryEngine.registerFunctions do not enforce databas…

    ArcadeData com.arcadedb arcadedb arcadedb-server Maven