Executive brief
NocoDB is a platform that turns databases into easy-to-use spreadsheets. A security flaw allows authorized users to link the platform to sensitive internal files on the server instead of intended data sources. This could allow a user to view or modify NocoDB's own configuration files or data belonging to other customers, potentially leading to data theft or service disruption.
Technical details
A path traversal vulnerability exists in NocoDB's SQLite source integration. The application accepts a user-supplied filename and passes it directly to file system operations (fs.exists and fs.open) without proper validation or path restriction. An authenticated attacker with 'base-create' permissions can provide a path to internal files, such as 'noco.db' or tenant databases in 'nc_minimal_dbs/'. Once attached as a source, the attacker can use standard table APIs to read or overwrite the contents of these files. This issue is resolved in version 2026.05.1.
Affected products
- NocoDB NocoDB < 2026.05.1
Timeline
- 2026-06-04: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: CVE published to NVD