CVE-2026-54077

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-54077

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54077.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-54077

Aliases

GHSA-8w86-m9h8-hvqg

Published

2026-09-15T15:17:35Z

Modified

2026-09-17T08:04:57Z

Severity

7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L CVSS Calculator

Summary

ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users

Details

ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not require administrative privileges and passed its source to integration/src/main/java/com/arcadedb/integration/importer/SourceDiscovery.java without validation. An authenticated user with SQL command access through /api/v1/command or /api/v1/query can supply HTTP or HTTPS destinations to make server-side requests to internal services, or file:// paths to read files accessible to the server process and ingest the results as queryable records. The XML importer also permits DTD processing and external entities, enabling entity expansion. The root-only /api/v1/server administration endpoint is not affected. The fix requires updateSecurity permission, blocks local-network import destinations by default through arcadedb.server.security.importBlockLocalNetworks, supports the arcadedb.server.security.importAllowedLocalPaths file allow-list, and disables XML DTD processing and external entities. This issue is fixed in version 26.6.1.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22",
        "CWE-776",
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54077.json"
}

References

Affected packages

Git / github.com/arcadedata/arcadedb

Affected ranges

Type

GIT

Repo

https://github.com/arcadedata/arcadedb

Events

Introduced

Fixed

bdc414cbdeda094cf8c20637cdc937335a3a19ee

Fixed

8cd72b1469113fc998101a29680fc2ef5d699b6e

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "26.6.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

21.*

21.10.1

21.10.2

21.11.1

21.12.1

21.9.1

22.*

22.1.2

22.1.3

22.10.1

22.11.1

22.12.1

22.2.1

22.6.1

22.8.1

22.9.1

23.*

23.1.1

23.1.2

23.10.1

23.11.1

23.12.1

23.12.2

23.2.1

23.3.1

23.4.1

23.5.1

23.6.1

23.7.1

23.9.1

24.*

24.1.1

24.10.1

24.11.1

24.11.2

24.2.1

24.4.1

24.5.1

24.6.1

25.*

25.1.1

25.10.1

25.11.1

25.12.1

25.2.1

25.3.1

25.3.2

25.4.1

25.6.1

25.7.1

25.8.1

25.9.1

26.*

26.1.1

26.2.1

26.3.1

26.3.2

26.4.2

26.5.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54077.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "292117894694577885857285559292760302901",
            "length": 3159
        },
        "id": "CVE-2026-54077-23156a26",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/arcadedata/arcadedb/commit/bdc414cbdeda094cf8c20637cdc937335a3a19ee",
        "target": {
            "file": "integration/src/main/java/com/arcadedb/integration/importer/format/XMLImporterFormat.java",
            "function": "load"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "211364691588153286579015262038304136321",
                "286879944242611323885008107895637246235",
                "306520250023992646620340877661422768095",
                "27350754070633504622058922575844946357",
                "164331568766196623759245724245499266288",
                "286879944242611323885008107895637246235",
                "306520250023992646620340877661422768095",
                "270826090909465399556486730762665801555"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-54077-307d07e4",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/arcadedata/arcadedb/commit/bdc414cbdeda094cf8c20637cdc937335a3a19ee",
        "target": {
            "file": "integration/src/main/java/com/arcadedb/integration/importer/format/XMLImporterFormat.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "66634131271059324680763194007969806629",
            "length": 1691
        },
        "id": "CVE-2026-54077-325803e9",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/arcadedata/arcadedb/commit/bdc414cbdeda094cf8c20637cdc937335a3a19ee",
        "target": {
            "file": "engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java",
            "function": "executeSimple"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "323391765103555763836333463663123352284",
                "290623990208687179781636643564877482636",
                "32259452598987573578599244338421354028"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-54077-3b3e5c29",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/arcadedata/arcadedb/commit/bdc414cbdeda094cf8c20637cdc937335a3a19ee",
        "target": {
            "file": "engine/src/main/java/com/arcadedb/GlobalConfiguration.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "69437880051271881718324080011128998297",
                "135514861468410304802062498252875338854",
                "250898266867789727796800836726715361843",
                "39732319020285728536516250983925273273",
                "91480219917616405940762135362609444893",
                "218409883869536817415384154594465156301",
                "294072108558438339211655375405951414193",
                "101608566119067366453276077467301686158",
                "43408587109978579517444318296466164470",
                "60206869087957760378183482335773337145",
                "270037019361035029476129821909386350147",
                "70342180613614708527366153021461990791"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-54077-5d3b52b2",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/arcadedata/arcadedb/commit/bdc414cbdeda094cf8c20637cdc937335a3a19ee",
        "target": {
            "file": "engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "13969205330193843671207287352421520909",
            "length": 196
        },
        "id": "CVE-2026-54077-ab991f98",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/arcadedata/arcadedb/commit/bdc414cbdeda094cf8c20637cdc937335a3a19ee",
        "target": {
            "file": "integration/src/main/java/com/arcadedb/integration/importer/SourceDiscovery.java",
            "function": "getSource"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "157379760724977458249725437212796284540",
            "length": 2906
        },
        "id": "CVE-2026-54077-ac4e4450",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/arcadedata/arcadedb/commit/bdc414cbdeda094cf8c20637cdc937335a3a19ee",
        "target": {
            "file": "integration/src/main/java/com/arcadedb/integration/importer/format/XMLImporterFormat.java",
            "function": "analyze"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "265513015568850758980877677148751529256",
                "191389964768841419600558737138411870930",
                "12202727117028095372947765039265987888",
                "89408691089917627094172039405865520809",
                "300715063536752324372420015641219134884",
                "334260522293358043997755497049777993906",
                "49987135405922403777912148996202946413"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-54077-b10a33cf",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/arcadedata/arcadedb/commit/bdc414cbdeda094cf8c20637cdc937335a3a19ee",
        "target": {
            "file": "integration/src/main/java/com/arcadedb/integration/importer/SourceDiscovery.java"
        }
    }
]

vanir_signatures_modified

"2026-09-17T08:04:57Z"