Skip to content
OpenAdvisories

Vendor

com.arcadedb

3 known vulnerabilities.

Products

arcadedb-engine 2 arcadedb-server 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.7
    CVE-2026-65831

    ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read

    ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-role user can submit POST /api/v1/command/{database} with language: js because PolyglotQueryEngine.command, PolyglotQueryEngine.analyze, and PolyglotQueryEngine.registerFunctions do not enforce databas…

    ArcadeData com.arcadedb arcadedb arcadedb-server Maven
  • High 7.1
    CVE-2026-54077

    ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users

    ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not require administrative privileges and passed its source to integration/src/main/java/com/…

    ArcadeData com.arcadedb arcadedb arcadedb-engine Maven
  • High 8.1
    CVE-2026-54076

    ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)

    ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATE_SCHEMA authorization check only to LocalDocumentType.createProperty, while the remaining public schema mutators in engine/src/main/java/com/arcadedb/schema/LocalDocume…

    ArcadeData com.arcadedb arcadedb arcadedb-engine Maven