EUVD-2026-45910
GHSA-pmgv-hp4m-3xjp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable query interface (AV:N/AC:L) usable only by an authenticated EDITOR/OWNER account (PR:L); leaked process secrets cross a trust boundary (S:C) for high confidentiality loss with no integrity or availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
4DescriptionCVE.org
SurrealDB before 3.1.5 contains an arbitrary file read vulnerability in the DEFINE ANALYZER mapper filter that allows database users with EDITOR or OWNER roles to read files accessible to the SurrealDB process. Attackers can specify arbitrary file paths in the mapper filter and retrieve file contents through query error messages when the SURREAL_FILE_ALLOWLIST is empty or not configured.
AnalysisAI
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role disclose files readable by the SurrealDB process by pointing the DEFINE ANALYZER mapper() filter at an arbitrary path and harvesting the content from query error messages. The flaw is exploitable in default deployments because the SURREAL_FILE_ALLOWLIST is empty by default and an empty allowlist enforced no restriction. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the GHSA advisory documents the technique in enough detail to reproduce.
Technical ContextAI
SurrealDB's full-text search supports custom text analyzers, and the mapper() filter (DEFINE ANALYZER ... FILTERS mapper('<path>')) loads a term-mapping file from local disk. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): the path supplied in SurrealQL was passed to the filesystem without effective containment. The intended containment mechanism, check_is_path_allowed against SURREAL_FILE_ALLOWLIST, treated an empty allowlist as 'allow everything' rather than 'deny everything', and empty is the shipped default. When the mapper file fails to parse, the analyzer error message echoes file content back to the caller, turning a parse error into an information-disclosure oracle. Only the first line of the target file is returned unless the file contains no newlines. The affected component is the Rust crate surrealdb (< 3.1.5).
RemediationAI
Vendor-released patch: upgrade to SurrealDB 3.1.5, in which check_is_path_allowed denies every path when no SURREAL_FILE_ALLOWLIST is configured (secure by default) and analyzer parse errors no longer include mapped-file contents, only the line number; the fix landed via https://github.com/surrealdb/surrealdb/pull/5600. If you cannot upgrade immediately, set SURREAL_FILE_ALLOWLIST to a directory containing only the intended mapping files - note that on affected versions the allowlist MUST be non-empty to have any effect, and this confines the mapper filter to that directory at the cost of blocking legitimate mapping files stored elsewhere. Additionally, grant EDITOR and OWNER database roles only to trusted principals to shrink the pool of potential abusers, and stop supplying secrets (especially root --user/--pass) on the command line or via environment variables - prefer mounted files with least-privilege permissions so a successful read yields less, though this changes your credential-provisioning workflow. See advisory GHSA-cc8f-fcx3-gpjr and the SurrealDB Capabilities docs (https://surrealdb.com/docs/surrealdb/security/capabilities).
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-act
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single Web
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process wi
Session hijacking in SurrealDB before 3.1.0 lets unauthenticated attackers enumerate attached session UUIDs through the
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belon
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with
Information disclosure in SurrealDB before 3.1.0 allows authenticated record or scope users to bypass table-level SELECT
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted
Broken authorization in SurrealDB before 3.1.4 allows record-scoped (authenticated) users to read array elements that fi
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today