Arbitrary file read via DEFINE ANALYZER mapper filter in SurrealDB (CVE-2026-63739)

SurrealDB's DEFINE ANALYZER mapper() filter allows database users with the EDITOR or OWNER role to specify arbitrary file paths and retrieve file contents through query error messages. File access is intended to be restricted by the SURREAL_FILE_ALLOWLIST setting, but an empty allowlist - which is the default - applies no restriction at all. Exploitation can expose sensitive files readable by the SurrealDB process, including command-line credentials and environment variables, potentially escalating a single-database role to full instance control. Affected versions: - <3.1.5 We recommend updating to: 3.1.5. CVSS 8.3 · our assessment: this_week Reference: https://github.com/surrealdb/surrealdb/security/advisories/GHSA-cc8f-fcx3-gpjr Details: https://vuln.today/cve/CVE-2026-63739