EUVD-2026-45910
GHSA-pmgv-hp4m-3xjp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable query interface (AV:N/AC:L) usable only by an authenticated EDITOR/OWNER account (PR:L); leaked process secrets cross a trust boundary (S:C) for high confidentiality loss with no integrity or availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
SurrealDB before 3.1.5 contains an arbitrary file read vulnerability in the DEFINE ANALYZER mapper filter that allows database users with EDITOR or OWNER roles to read files accessible to the SurrealDB process. Attackers can specify arbitrary file paths in the mapper filter and retrieve file contents through query error messages when the SURREAL_FILE_ALLOWLIST is empty or not configured.
AnalysisAI
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role disclose files readable by the SurrealDB process by pointing the DEFINE ANALYZER mapper() filter at an arbitrary path and harvesting the content from query error messages. The flaw is exploitable in default deployments because the SURREAL_FILE_ALLOWLIST is empty by default and an empty allowlist enforced no restriction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated SurrealDB account with the EDITOR or OWNER role and the ability to run DEFINE ANALYZER with a mapper() filter, into which the attacker supplies an arbitrary absolute file path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N, base 8.3) is internally consistent with the description: network-reachable, low complexity, requires low privileges (a legitimate EDITOR/OWNER database account, i.e. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who holds (or compromises) a SurrealDB account with the EDITOR or OWNER role issues a DEFINE ANALYZER statement whose mapper() filter points at /proc/self/environ or /proc/self/cmdline. The resulting parse error returns the first line of that file, disclosing the process's startup root credentials or secret environment variables, which the attacker reuses to take over the instance. … |
| Remediation | Vendor-released patch: upgrade to SurrealDB 3.1.5, in which check_is_path_allowed denies every path when no SURREAL_FILE_ALLOWLIST is configured (secure by default) and analyzer parse errors no longer include mapped-file contents, only the line number; the fix landed via https://github.com/surrealdb/surrealdb/pull/5600. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all SurrealDB deployments to identify affected versions and document users holding EDITOR and OWNER roles. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today