CVE-2026-54077
Received Received - Intake

SQL Injection and XXE in ArcadeDB via IMPORT DATABASE

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not require administrative privileges and passed its source to integration/src/main/java/com/arcadedb/integration/importer/SourceDiscovery.java without validation. An authenticated user with SQL command access through /api/v1/command or /api/v1/query can supply HTTP or HTTPS destinations to make server-side requests to internal services, or file:// paths to read files accessible to the server process and ingest the results as queryable records. The XML importer also permits DTD processing and external entities, enabling entity expansion. The root-only /api/v1/server administration endpoint is not affected. The fix requires updateSecurity permission, blocks local-network import destinations by default through arcadedb.server.security.importBlockLocalNetworks, supports the arcadedb.server.security.importAllowedLocalPaths file allow-list, and disables XML DTD processing and external entities. This issue is fixed in version 26.6.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-54077
EUVD
EUVD-2026-78786

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
arcadedb arcadedb to 26.6.1 (exc)
arcadedb arcadedb 26.6.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-776 The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-54077 is a vulnerability in ArcadeDB versions before 26.6.1 where the IMPORT DATABASE SQL command allowed authenticated users to perform Server-Side Request Forgery (SSRF), read arbitrary local files, and exploit XML External Entity (XXE) vulnerabilities. The command did not require administrative privileges and accepted unvalidated sources, enabling access to internal services or local files via HTTP(S) or file:// paths. The XML importer also permitted DTD processing and external entities, allowing entity expansion attacks.

Detection Guidance

Check for unauthorized IMPORT DATABASE commands in server logs, particularly those accessing HTTP(S) or file:// sources. Monitor for HTTP 403 errors indicating blocked import attempts. Review XML importer logs for DTD processing attempts.

Impact Analysis

An attacker with SQL command access could exploit this to make unauthorized server-side requests to internal or external services, read sensitive files on the server, or perform XXE attacks to consume server resources or access restricted data. This could lead to data breaches, service disruption, or further network compromise depending on the server's environment and configuration.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR (data protection and breach notification) or HIPAA (protected health information security) by enabling unauthorized access to sensitive data. Organizations using vulnerable versions may face regulatory penalties, reputational damage, and increased audit scrutiny due to inadequate access controls and data protection measures.

Mitigation Strategies

Upgrade ArcadeDB to version 26.6.1 or later. Restrict SQL command access to trusted users only. Review and configure arcadedb.server.security.importBlockLocalNetworks and arcadedb.server.security.importAllowedLocalPaths settings.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54077. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart