Vulnerability · Published Aug 18, 2026 · Assigned by VulnCheck
CVE-2026-75842ArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSV
High 7.7
In plain English
A high-severity path traversal in arcadedb from ArcadeData. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Severity (CVSS 3.1)7.7High
Exploit odds (30 days)0.5%top 60.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server process privileges, exfiltrating sensitive data directly in query responses.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ArcadeData | arcadedb | 0 – before 26.8.1 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
References
- GitHub Security Advisory (GHSA-hfp5-6gcp-8c75) vendor-advisory
- VulnCheck Advisory: ArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSV third-party-advisory