CVE-2026-75842
Received Received - Intake

Arbitrary File Read in ArcadeDB via OpenCypher LOAD CSV

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: VulnCheck

Description
ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server process privileges, exfiltrating sensitive data directly in query responses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-75842
EUVD
EUVD-2026-60606

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
arcadedb arcadedb to 26.8.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an arbitrary file read issue in ArcadeDB versions before 26.8.1. It exists in the OpenCypher LOAD CSV FROM clause where authenticated users with read privileges can exploit the file:// protocol to access local files on the server with the server process privileges. Attackers can exfiltrate sensitive data directly through query responses.

Detection Guidance

Check ArcadeDB server logs for suspicious LOAD CSV queries using file:// protocol. Look for queries containing 'LOAD CSV FROM file://' or attempts to access sensitive paths like /etc/passwd or application configuration files. Enable query logging if not already active and monitor for unauthorized file access patterns.

Impact Analysis

If you use an affected ArcadeDB version, attackers with read query access could read sensitive files on your server, such as configuration files, secrets, or system files like /etc/passwd. This could lead to data breaches, unauthorized access to credentials, or further system compromise depending on the exposed data.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive personal or health data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade ArcadeDB to version 26.8.1 or later immediately. If upgrading is not possible, disable file URL access by setting OPENCYPHER_LOAD_CSV_ALLOW_FILE_URLS=false in configuration. Restrict database user permissions to prevent arbitrary query execution. Monitor network traffic for suspicious LOAD CSV queries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75842. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart