Vulnerability Description
ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforcement, which uses unescaped regular expressions to validate package names. Attackers with trigger creation privileges can use Java.type() to access java.util.zip.ZipFile or java.util.jar.JarFile classes and read arbitrary files on the host system as the ArcadeDB server process.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-wx28-2265-f788
- https://www.vulncheck.com/advisories/arcadedb-before-arbitrary-file-read-via-une
- https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-wx28-2265-f788
FAQ
What is CVE-2026-75840?
CVE-2026-75840 is a vulnerability with a CVSS score of 7.5 (HIGH). ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforcement, which uses unescaped regular expressions to validate package names. Attack...
How severe is CVE-2026-75840?
CVE-2026-75840 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-75840?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.