# CVE-2026-75842: ArcadeDB arbitrary file read in OpenCypher LOAD CSV

Source: https://junglewise.ai/threats/cve-2026-75842-arcadedb-arbitrary-file-read-in-opencypher-load-csv  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75842 · Severity: high · CVSS 7.7 · Published 2026-08-18

ArcadeDB is a graph database system used to store and query structured data. An authentication bypass vulnerability allows any authenticated user with read query privileges to access arbitrary files on the server using the LOAD CSV command, potentially exposing sensitive files like configuration secrets and credentials with the privileges of the database server process.

Technologies: [ArcadeData ArcadeDB](https://junglewise.ai/threats/technologies/arcadedb). Vendors: [ArcadeData](https://junglewise.ai/threats/vendors/arcadedata).

## Quick answers

**Is CVE-2026-75842 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75842 being exploited in the wild.

**How severe is CVE-2026-75842?** High severity, with a CVSS score of 7.7, published 18 August 2026.

**Which products and versions are affected?** ArcadeData ArcadeDB before 26.8.1, specifically <= 26.7.3.

**Is there a fix for CVE-2026-75842?** A patch was published on 2026-08-18: Patch released in version 26.8.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75842 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-75842?** Check whether you run ArcadeData ArcadeDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a path traversal / arbitrary file read flaw in the OpenCypher query engine's LOAD CSV FROM statement. The root cause is absent permission checks on the file:// protocol handler combined with permissive default configuration: the OPENCYPHER_LOAD_CSV_ALLOW_FILE_URLS flag defaults to true and OPENCYPHER_LOAD_CSV_IMPORT_DIRECTORY defaults to empty string, allowing any file path to be resolved without restriction. Authenticated users with read query privileges can exploit this via a POST request to /api/v1/query/{db} containing a LOAD CSV statement with a file:// URL (e.g., file:///etc/passwd), causing the server to open the file with its own process privileges and stream each line back as a query result. No privilege escalation is required beyond basic read query access. The vulnerability was patched in version 26.8.1 by adding proper authorization gates and changing configuration defaults.

## Affected products

- ArcadeData ArcadeDB before 26.8.1, specifically <= 26.7.3

## Timeline

- 2026-08-04: disclosed: GitHub Security Advisory GHSA-hfp5-6gcp-8c75 published
- 2026-08-18: patched: Patch released in version 26.8.1

## References

- [https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-hfp5-6gcp-8c75](https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-hfp5-6gcp-8c75)
- [https://www.vulncheck.com/advisories/arcadedb-before-arbitrary-file-read-via-load-csv](https://www.vulncheck.com/advisories/arcadedb-before-arbitrary-file-read-via-load-csv)

## Related threats

- [ArcadeDB improper authorization in wire-protocol connections](https://junglewise.ai/threats/cve-2026-119577-arcadedb-before-26-10-2-contains-an-improper-authorization)
- [ArcadeDB authorization bypass in GraphQL schema endpoint](https://junglewise.ai/threats/cve-2026-119576-arcadedb-from-21-12-1-before-26-10-2-contains-an-authorization)
- [ArcadeDB server-side request forgery in LOAD CSV](https://junglewise.ai/threats/cve-2026-119575-arcadedb-from-26-8-1-before-26-10-2-contains-a-server-side)
- [ArcadeDB remote code execution in Gremlin Groovy engine](https://junglewise.ai/threats/cve-2026-114059-arcadedb-before-26-10-1-contains-a-remote-code-execution)
- [ArcadeDB Bolt protocol missing authorization](https://junglewise.ai/threats/cve-2026-114058-arcadedb-from-26-2-1-before-26-10-1-contains-a-missing)