CVE-2026-75840
Received Received - Intake

Arbitrary File Read in ArcadeDB via GraalVM JavaScript Sandbox Bypass

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: VulnCheck

Description
ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforcement, which uses unescaped regular expressions to validate package names. Attackers with trigger creation privileges can use Java.type() to access java.util.zip.ZipFile or java.util.jar.JarFile classes and read arbitrary files on the host system as the ArcadeDB server process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-75840
EUVD
EUVD-2026-60604

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
arcadedb arcadedb to 26.8.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1025 The code performs a comparison between two entities, but the comparison examines the wrong factors or characteristics of the entities, which can lead to incorrect results and resultant weaknesses.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ArcadeDB before version 26.8.1 has a flaw in its GraalVM JavaScript sandbox where allowlist entries for Java packages are checked using unescaped regular expressions. This allows attackers with trigger creation privileges to bypass restrictions and access unintended packages like java.util.zip.* and java.util.jar.*, which contain classes capable of reading arbitrary files on the host system as the ArcadeDB server process.

Detection Guidance

Check ArcadeDB server logs for suspicious JavaScript trigger executions or file access attempts. Monitor for unauthorized use of Java.type() calls in triggers or scripts. Verify ArcadeDB version is 26.8.1 or later to confirm patch status.

Impact Analysis

An attacker could exploit this to read sensitive files on the server where ArcadeDB is running, potentially exposing credentials, configuration files, or other confidential data. This is possible even with low privileges like UPDATE_SCHEMA, which are required to create triggers.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR and HIPAA which mandate protection of personal and health information. Unauthorized file access may result in data breaches, triggering legal and regulatory penalties.

Mitigation Strategies

Upgrade ArcadeDB to version 26.8.1 or later immediately. Review and restrict UPDATE_SCHEMA privileges to prevent trigger creation by untrusted users. Audit existing triggers for malicious JavaScript code.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75840. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart