SQLite Arbitrary File Read/Write in NocoDB

Compliance Impact

This vulnerability allows an authenticated user with base-create permission to read or overwrite arbitrary files on the NocoDB host, including internal databases. Such unauthorized access and modification of data could lead to breaches of data confidentiality and integrity.

As a result, this vulnerability may impact compliance with data protection regulations such as GDPR and HIPAA, which require strict controls over access to sensitive data and the integrity of stored information.

Useful 0 Not Useful 0

Executive Summary

This vulnerability affects NocoDB software versions prior to 2026.05.1. An authenticated user with base-create permission can attach a SQLite source that points to any arbitrary file on the NocoDB host system, including NocoDB's own internal databases.

The SQLite client and related services accepted a user-supplied filename and used it to check for file existence and open the file for writing without restricting the file location. This allows the user to read or overwrite contents of important files such as noco.db or tenant databases, through the normal table APIs.

This vulnerability was fixed in version 2026.05.1.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an authenticated user with limited permissions to read or modify sensitive database files on the NocoDB host. This could lead to unauthorized data access, data corruption, or data loss.

Since the user can overwrite internal databases, it may compromise the integrity and availability of the data managed by NocoDB.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade NocoDB to version 2026.05.1 or later, where the issue is fixed.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an authenticated user with base-create permission attaching a SQLite source pointing to arbitrary files on the NocoDB host. Detection involves monitoring for unusual or unauthorized SQLite source attachments referencing sensitive or internal database files.

To detect exploitation attempts, you can audit NocoDB logs for base-create actions where the SQLite source filename parameter points to unexpected or sensitive paths such as 'noco.db' or directories like 'nc_minimal_dbs/'.

Since the vulnerability involves filesystem access via user-supplied filenames, commands to check for suspicious files or processes might include:

• Review NocoDB application logs for base-create operations with suspicious file paths.
• Use grep or similar tools to search logs for keywords like 'noco.db' or 'nc_minimal_dbs' in SQLite source attachments.
• Example command to search logs: grep -iE 'base-create.*(noco\.db|nc_minimal_dbs)' /path/to/nocodb/logs/*
• Monitor filesystem access to sensitive database files using tools like auditd or inotify to detect unexpected write or open operations.
• Check for unusual network activity or API calls that involve creating or modifying SQLite sources.

Useful 0 Not Useful 0