Vulnerability Description
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with base-create permission can attach a SQLite source pointing at an arbitrary file on the NocoDB host, including NocoDB's own internal databases. The SQLite client and the base/integration create services accepted a caller-supplied filename and passed it to fs.exists and fs.open('w') without restricting the location. A user could point a source at noco.db, at a tenant database under nc_minimal_dbs/, or at any writable path the NocoDB process can reach, and then read or overwrite its contents through the regular table APIs.This vulnerability is fixed in 2026.05.1.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-47385?
CVE-2026-47385 is a documented vulnerability. NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with base-create permission can attach a SQLite source pointing at an arbitrary file on the NocoDB ...
How severe is CVE-2026-47385?
CVSS scoring is not yet available for CVE-2026-47385. Check NVD for updates.
Is there a patch for CVE-2026-47385?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.