Executive brief
ArcadeDB is a graph database system used to store and query structured data. An authentication bypass vulnerability allows any authenticated user with read query privileges to access arbitrary files on the server using the LOAD CSV command, potentially exposing sensitive files like configuration secrets and credentials with the privileges of the database server process.
Technical details
The vulnerability is a path traversal / arbitrary file read flaw in the OpenCypher query engine's LOAD CSV FROM statement. The root cause is absent permission checks on the file:// protocol handler combined with permissive default configuration: the OPENCYPHER_LOAD_CSV_ALLOW_FILE_URLS flag defaults to true and OPENCYPHER_LOAD_CSV_IMPORT_DIRECTORY defaults to empty string, allowing any file path to be resolved without restriction. Authenticated users with read query privileges can exploit this via a POST request to /api/v1/query/{db} containing a LOAD CSV statement with a file:// URL (e.g., file:///etc/passwd), causing the server to open the file with its own process privileges and stream each line back as a query result. No privilege escalation is required beyond basic read query access. The vulnerability was patched in version 26.8.1 by adding proper authorization gates and changing configuration defaults.
Affected products
- ArcadeData ArcadeDB before 26.8.1, specifically <= 26.7.3
Timeline
- 2026-08-04: disclosed: GitHub Security Advisory GHSA-hfp5-6gcp-8c75 published
- 2026-08-18: patched: Patch released in version 26.8.1