What is the CVSS score of CVE-2026-54077?

CVE-2026-54077 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L.

Which versions of ArcadeDB are affected by CVE-2026-54077?

ArcadeDB versions before 26.6.1 allow standard SQL users to circumvent security controls and read credential files, system configuration, and access internal cloud services-enabling credential theft…. A patch is available.

How to fix or mitigate CVE-2026-54077?

Within 24 hours, inventory all systems running ArcadeDB prior to version 26.6.1 and immediately restrict SQL IMPORT DATABASE command access to trusted administrative staff; enable and review access logs for any unauthorized queries. Within 7 days, apply vendor-released patch to upgrade to ArcadeDB 26.6.1 in non-production environments and validate functionality before scheduling production deployment. Within 30 days, complete production patching to version 26.6.1, conduct forensic review of SQL query logs from the past 90 days for evidence of SSRF or file-read abuse, and re-establish least-privilege access controls limiting SQL command execution to necessary personnel only.

ArcadeDB CVE-2026-54077

EUVD-2026-78786 HIGH

Path Traversal (CWE-22)

2026-07-16 https://github.com/ArcadeData/arcadedb

GHSA-8w86-m9h8-hvqg

Java Path Traversal SSRF

7.1

CVSS 3.1 · Vendor: https://github.com/ArcadeData/arcadedb

Severity by source

Vendor (https://github.com/ArcadeData/arcadedb) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

vuln.today AI

7.6 HIGH

Network-reachable SQL endpoint with only low-privileged authentication (PR:L), no user interaction; high confidentiality from file/metadata read, low integrity since fetched data is written as records, low availability from DTD entity expansion.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/ArcadeData/arcadedb).

CVSS VectorVendor: https://github.com/ArcadeData/arcadedb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Source Code Evidence Fetched

Jul 16, 2026 - 20:33 vuln.today

Analysis Generated

Jul 16, 2026 - 20:33 vuln.today

CVE Published

Jul 16, 2026 - 20:05 github-advisory

HIGH 7.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

16 maven packages depend on com.arcadedb:arcadedb-engine (8 direct, 8 indirect)

Ecosystem-wide dependent count for version 26.6.1.

DescriptionCVE.org

Impact

The SQL IMPORT DATABASE statement did not require administrative privileges and passed its source URL to the importer without validation. Any authenticated user with SQL command access (not only root/administrators) could therefore:

Server-Side Request Forgery (CWE-918): cause the server to issue HTTP(S) requests to arbitrary destinations, including cloud metadata endpoints (e.g. 169.254.169.254) and internal-only services, and ingest the responses as queryable records.
Arbitrary local file read (CWE-22): read local files reachable by the server process (e.g. /etc/passwd, credential files) by importing file:// paths, exposing their contents as records.

The server administration endpoint (/api/v1/server) was already restricted to the root user and was not affected; the exposure was through the database SQL command/query endpoints (/api/v1/command, /api/v1/query).

A related lower-severity hardening gap (CWE-776): the XML importer did not disable DTD processing, leaving entity-expansion (Billion Laughs) possible.

Affected component

integration/src/main/java/com/arcadedb/integration/importer/SourceDiscovery.java (no host allow-list for http(s); no path validation for file://), reached from engine/.../query/sql/parser/ImportDatabaseStatement.java.

Patches

IMPORT DATABASE now requires the administrative updateSecurity permission (no-op in embedded mode).
Import sources are validated in SourceDiscovery: HTTP(S) hosts resolving to loopback / link-local / private (site-local) / wildcard / multicast addresses are blocked by default (arcadedb.server.security.importBlockLocalNetworks, default true), and an optional local-path allow-list (arcadedb.server.security.importAllowedLocalPaths) restricts file:// reads.
The XML importer now disables DTD processing and external entities.

Fixed in commit referenced by pull request #4422.

Workarounds

Restrict SQL command/query access to trusted administrative users; do not grant query access to untrusted users on servers that can reach sensitive networks or hold sensitive local files. Upgrading is strongly recommended.

Credit

Reported by Bin Luo (luob87709@gmail.com).

Articles & Coverage 1

News 6 New Java Vulnerabilities - 1 Critical, 5 High, 1 With POC Jul 17, 2026

AnalysisAI

Server-Side Request Forgery and arbitrary local file read in ArcadeDB before 26.6.1 let any authenticated user with SQL command/query access - not just root/administrators - abuse the SQL IMPORT DATABASE statement, whose source URL was passed to the importer unchecked. Because it required no administrative privileges, a low-privileged user could force the server to fetch arbitrary HTTP(S) endpoints (including cloud metadata at 169.254.169.254 and internal-only services) and ingest the responses as queryable records, or read local files such as /etc/passwd and credential files via file:// paths. No public exploit identified at time of analysis; the flaw was privately reported and fixed in release 26.6.1.

Technical ContextAI

ArcadeDB is a Java-based multi-model (graph/document/key-value/time-series) database exposing an HTTP API and an OrientDB-like SQL dialect. The vulnerability lives in the importer subsystem: integration/src/main/java/com/arcadedb/integration/importer/SourceDiscovery.java had no host allow-list for http(s) sources and no path validation for file:// sources, and it was reachable from engine/.../query/sql/parser/ImportDatabaseStatement.java via the /api/v1/command and /api/v1/query endpoints. The primary root cause is CWE-22 (Path Traversal / improper limitation of a pathname) for the file:// local-file read, combined with CWE-918 (SSRF) for the outbound-request abuse - a classic pattern where a user-supplied URL is dereferenced server-side without scheme, host, or path restrictions. A secondary CWE-776 (improper restriction of recursive entity references) exists because the XML importer left DTD processing and external entities enabled, permitting Billion Laughs entity-expansion. The already-hardened /api/v1/server administration endpoint (root-only) was not the exposure path; the SQL command/query endpoints were.

RemediationAI

Vendor-released patch: upgrade to ArcadeDB 26.6.1 (https://github.com/ArcadeData/arcadedb/releases/tag/26.6.1), which fixes the issue via pull request #4422. The patch requires the administrative updateSecurity permission to run IMPORT DATABASE, validates import sources in SourceDiscovery so HTTP(S) hosts resolving to loopback, link-local, private/site-local, wildcard, or multicast addresses are blocked by default (config arcadedb.server.security.importBlockLocalNetworks, default true), adds an optional file:// allow-list (arcadedb.server.security.importAllowedLocalPaths), and disables DTD/external-entity processing in the XML importer. If you cannot upgrade immediately, apply the vendor workaround: restrict SQL command/query access (/api/v1/command, /api/v1/query) to trusted administrative users only and do not grant SQL query access to untrusted or lower-tier users - the trade-off is reduced self-service query access for non-admin accounts. As additional compensating controls, place the server on a network segment that cannot reach cloud metadata endpoints (169.254.169.254) or sensitive internal services, and run the server process under a least-privilege OS account whose filesystem access excludes credential and secret files, accepting that this constrains legitimate local-import use cases. Consult GHSA-8w86-m9h8-hvqg for authoritative details.