What is the CVSS score of CVE-2026-54077?

CVE-2026-54077 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L.

Which versions of ArcadeDB are affected by CVE-2026-54077?

ArcadeDB versions before 26.6.1 allow standard SQL users to circumvent security controls and read credential files, system configuration, and access internal cloud services-enabling credential theft…. A patch is available.

How to fix or mitigate CVE-2026-54077?

Within 24 hours, inventory all systems running ArcadeDB prior to version 26.6.1 and immediately restrict SQL IMPORT DATABASE command access to trusted administrative staff; enable and review access logs for any unauthorized queries. Within 7 days, apply vendor-released patch to upgrade to ArcadeDB 26.6.1 in non-production environments and validate functionality before scheduling production deployment. Within 30 days, complete production patching to version 26.6.1, conduct forensic review of SQL query logs from the past 90 days for evidence of SSRF or file-read abuse, and re-establish least-privilege access controls limiting SQL command execution to necessary personnel only.

ArcadeDB CVE-2026-54077

HIGH

Path Traversal (CWE-22)

2026-07-16 https://github.com/ArcadeData/arcadedb

GHSA-8w86-m9h8-hvqg

Path Traversal SSRF Java

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

vuln.today AI

7.6 HIGH

Network-reachable SQL endpoint with only low-privileged authentication (PR:L), no user interaction; high confidentiality from file/metadata read, low integrity since fetched data is written as records, low availability from DTD entity expansion.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Source Code Evidence Fetched

Jul 16, 2026 - 20:33 vuln.today

Analysis Generated

Jul 16, 2026 - 20:33 vuln.today

CVE Published

Jul 16, 2026 - 20:05 github-advisory

HIGH 7.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

16 maven packages depend on com.arcadedb:arcadedb-engine (8 direct, 8 indirect)

Ecosystem-wide dependent count for version 26.6.1.

DescriptionGitHub Advisory

Impact

The SQL IMPORT DATABASE statement did not require administrative privileges and passed its source URL to the importer without validation. Any authenticated user with SQL command access (not only root/administrators) could therefore:

Server-Side Request Forgery (CWE-918): cause the server to issue HTTP(S) requests to arbitrary destinations, including cloud metadata endpoints (e.g. 169.254.169.254) and internal-only services, and ingest the responses as queryable records.
Arbitrary local file read (CWE-22): read local files reachable by the server process (e.g. /etc/passwd, credential files) by importing file:// paths, exposing their contents as records.

The server administration endpoint (/api/v1/server) was already restricted to the root user and was not affected; the exposure was through the database SQL command/query endpoints (/api/v1/command, /api/v1/query).

A related lower-severity hardening gap (CWE-776): the XML importer did not disable DTD processing, leaving entity-expansion (Billion Laughs) possible.

Affected component

integration/src/main/java/com/arcadedb/integration/importer/SourceDiscovery.java (no host allow-list for http(s); no path validation for file://), reached from engine/.../query/sql/parser/ImportDatabaseStatement.java.

Patches

IMPORT DATABASE now requires the administrative updateSecurity permission (no-op in embedded mode).
Import sources are validated in SourceDiscovery: HTTP(S) hosts resolving to loopback / link-local / private (site-local) / wildcard / multicast addresses are blocked by default (arcadedb.server.security.importBlockLocalNetworks, default true), and an optional local-path allow-list (arcadedb.server.security.importAllowedLocalPaths) restricts file:// reads.
The XML importer now disables DTD processing and external entities.

Fixed in commit referenced by pull request #4422.

Workarounds

Restrict SQL command/query access to trusted administrative users; do not grant query access to untrusted users on servers that can reach sensitive networks or hold sensitive local files. Upgrading is strongly recommended.

Credit

Reported by Bin Luo (luob87709@gmail.com).

Articles & Coverage 1

News 6 New Java Vulnerabilities - 1 Critical, 5 High, 1 With POC Jul 17, 2026

AnalysisAI

Server-Side Request Forgery and arbitrary local file read in ArcadeDB before 26.6.1 let any authenticated user with SQL command/query access - not just root/administrators - abuse the SQL IMPORT DATABASE statement, whose source URL was passed to the importer unchecked. Because it required no administrative privileges, a low-privileged user could force the server to fetch arbitrary HTTP(S) endpoints (including cloud metadata at 169.254.169.254 and internal-only services) and ingest the responses as queryable records, or read local files such as /etc/passwd and credential files via file:// paths. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate with SQL command access

Delivery

Submit IMPORT DATABASE with crafted source URL

Exploit

Server fetches metadata endpoint or reads file:// path

Execution

Response ingested as queryable records

Impact

Query back exfiltrated credentials or file contents

Access

Authenticate with SQL command access

Delivery

Submit IMPORT DATABASE with crafted source URL

Exploit

Server fetches metadata endpoint or reads file:// path

Execution

Response ingested as queryable records

Impact

Query back exfiltrated credentials or file contents

Vulnerability AssessmentAI

Exploitation	Exploitation requires an authenticated ArcadeDB account (any user with SQL command/query access via `/api/v1/command` or `/api/v1/query`) on a server-mode deployment; administrative/root privileges are NOT required, which is the core of the flaw. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, base 7.1) aligns well with the description: network-reachable, low complexity, requires low-level authentication (PR:L - any user with SQL access, so authenticated but not administrative), no user interaction, high confidentiality impact (file/metadata disclosure), no integrity impact, and low availability impact (consistent with the Billion Laughs DTD expansion). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who holds a non-administrative ArcadeDB account with SQL command access authenticates to `/api/v1/command` and issues an `IMPORT DATABASE` statement pointing at `http://169.254.169.254/latest/meta-data/iam/security-credentials/`, causing the server to fetch the cloud IAM credentials and store them as queryable records the attacker can then read back. Alternatively they import a `file:///etc/passwd` (or a config/credential file) path to exfiltrate local file contents. …
Remediation	Vendor-released patch: upgrade to ArcadeDB 26.6.1 (https://github.com/ArcadeData/arcadedb/releases/tag/26.6.1), which fixes the issue via pull request #4422. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all systems running ArcadeDB prior to version 26.6.1 and immediately restrict SQL IMPORT DATABASE command access to trusted administrative staff; enable and review access logs for any unauthorized queries. …

Threat intelligence, references, and detailed analysis are available after sign-in.