SSRF and file read in ArcadeDB (CVE-2026-54077)

CVE-2026-54077 is a vulnerability in ArcadeDB's `IMPORT DATABASE` SQL statement that allowed any authenticated user with SQL command access to perform Server-Side Request Forgery (CWE-918) and arbitrary local file reads (CWE-22) by supplying unvalidated URLs or `file://` paths. This exposed internal network services, cloud metadata endpoints, and server-local files such as credential files to unauthorized disclosure. A related lower-severity issue (CWE-776) permitted XML entity-expansion (Billion Laughs) attacks due to DTD processing not being disabled in the XML importer. Affected versions: - <= 26.5.1 We recommend updating to: 26.6.1. CVSS 7.1 · our assessment: this_week Vendor advisory: https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-8w86-m9h8-hvqg Details: https://vuln.today/cve/CVE-2026-54077