Vulnerability · Published Jun 23, 2026 · Assigned by GitHub_M
CVE-2026-47385NocoDB: Path Traversal via SQLite Source Filename
Medium 5.3
In plain English
A medium-severity path traversal in nocodb from nocodb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with base-create permission can attach a SQLite source pointing at an arbitrary file on the NocoDB host, including NocoDB's own internal databases. The SQLite client and the base/integration create services accepted a caller-supplied filename and passed it to fs.exists and fs.open('w') without restricting the location. A user could point a source at noco.db, at a tenant database under nc_minimal_dbs/, or at any writable path the NocoDB process can reach, and then read or overwrite its contents through the regular table APIs.This vulnerability is fixed in 2026.05.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | nocodb | 2026.05.1 | GHSA-wvqj-9wv4-7ff5 |
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/nocodb/nocodb/security/advisories/GHSA-wvqj-9wv4-7ff5 x_refsource_CONFIRM