CVE-2026-54077: ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportD

Executive brief

ArcadeDB is a multi-model database engine. A vulnerability in its database import feature allows any authenticated user to perform unauthorized network requests or read sensitive files from the server's local storage. This could lead to the exposure of internal system credentials, configuration files, or access to private internal services that are otherwise protected from the internet.

Technical details

The SQL 'IMPORT DATABASE' statement in ArcadeDB failed to validate source URLs and did not require administrative privileges. An authenticated attacker with SQL command access can provide a 'file://' URI to read arbitrary local files (such as /etc/passwd) or an 'http(s)://' URI to perform SSRF against internal services or cloud metadata endpoints (e.g., 169.254.169.254). The vulnerability exists in the SourceDiscovery.java component. Additionally, the XML importer was found to be vulnerable to XML Entity Expansion (Billion Laughs) attacks due to enabled DTD processing. These issues are resolved in version 26.6.1 by requiring 'updateSecurity' permissions for imports and implementing a host/path allow-list.

Affected products

• ArcadeData arcadedb-engine < 26.6.1

Timeline

• 2026-06-03: patched: Release 26.6.1 published
• 2026-07-16: advisory: GitHub Advisory published

References

• https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-8w86-m9h8-hvqg
• https://github.com/ArcadeData/arcadedb/releases/tag/26.6.1
• https://api.github.com/repos/ArcadeData/arcadedb/security-advisories/GHSA-8w86-m9h8-hvqg