Vulnerability Description
ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server process privileges, exfiltrating sensitive data directly in query responses.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-hfp5-6gcp-8c75
- https://www.vulncheck.com/advisories/arcadedb-before-arbitrary-file-read-via-loa
- https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-hfp5-6gcp-8c75
FAQ
What is CVE-2026-75842?
CVE-2026-75842 is a vulnerability with a CVSS score of 7.7 (HIGH). ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privi...
How severe is CVE-2026-75842?
CVE-2026-75842 has been rated HIGH with a CVSS base score of 7.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-75842?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.