GHSA-8w86-m9h8-hvqg

Suggest an improvement
Source
https://github.com/advisories/GHSA-8w86-m9h8-hvqg
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-8w86-m9h8-hvqg/GHSA-8w86-m9h8-hvqg.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-8w86-m9h8-hvqg
Aliases
Published
2026-07-16T20:05:56Z
Modified
2026-07-16T20:26:44Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L CVSS Calculator
Summary
ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users
Details

Impact

The SQL IMPORT DATABASE statement did not require administrative privileges and passed its source URL to the importer without validation. Any authenticated user with SQL command access (not only root/administrators) could therefore:

  • Server-Side Request Forgery (CWE-918): cause the server to issue HTTP(S) requests to arbitrary destinations, including cloud metadata endpoints (e.g. 169.254.169.254) and internal-only services, and ingest the responses as queryable records.
  • Arbitrary local file read (CWE-22): read local files reachable by the server process (e.g. /etc/passwd, credential files) by importing file:// paths, exposing their contents as records.

The server administration endpoint (/api/v1/server) was already restricted to the root user and was not affected; the exposure was through the database SQL command/query endpoints (/api/v1/command, /api/v1/query).

A related lower-severity hardening gap (CWE-776): the XML importer did not disable DTD processing, leaving entity-expansion (Billion Laughs) possible.

Affected component

integration/src/main/java/com/arcadedb/integration/importer/SourceDiscovery.java (no host allow-list for http(s); no path validation for file://), reached from engine/.../query/sql/parser/ImportDatabaseStatement.java.

Patches

  • IMPORT DATABASE now requires the administrative updateSecurity permission (no-op in embedded mode).
  • Import sources are validated in SourceDiscovery: HTTP(S) hosts resolving to loopback / link-local / private (site-local) / wildcard / multicast addresses are blocked by default (arcadedb.server.security.importBlockLocalNetworks, default true), and an optional local-path allow-list (arcadedb.server.security.importAllowedLocalPaths) restricts file:// reads.
  • The XML importer now disables DTD processing and external entities.

Fixed in commit referenced by pull request #4422.

Workarounds

Restrict SQL command/query access to trusted administrative users; do not grant query access to untrusted users on servers that can reach sensitive networks or hold sensitive local files. Upgrading is strongly recommended.

Credit

Reported by Bin Luo (luob87709@gmail.com).

Database specific 
{
    "cwe_ids":  [
        "CWE-22",
        "CWE-776",
        "CWE-918"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-16T20:05:56Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}
References

Affected packages

Maven / com.arcadedb:arcadedb-engine

Package

Name
com.arcadedb:arcadedb-engine
View open source insights on deps.dev
Purl
pkg:maven/com.arcadedb/arcadedb-engine

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
26.6.1

Affected versions

21.*
21.9.1-beta
21.9.1
21.10.1
21.10.2
21.11.1
21.12.1
22.*
22.1.1
22.1.2
22.1.3
22.2.1
22.8.1
22.9.1
22.10.1
22.11.1
22.12.1
23.*
23.1.1
23.1.2
23.2.1
23.3.1
23.4.1
23.5.1
23.6.1
23.7.1
23.9.1
23.10.1
23.11.1
23.12.1
23.12.2
24.*
24.1.1
24.2.1
24.4.1
24.5.1
24.6.1
24.10.1
24.11.1
24.11.2
25.*
25.1.1
25.2.1
25.3.1
25.3.2
25.4.1
25.5.1
25.6.1
25.7.1
25.8.1
25.9.1
25.10.1
25.11.1
25.12.1
26.*
26.1.1
26.2.1
26.2.2
26.3.1
26.3.2
26.4.2
26.5.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-8w86-m9h8-hvqg/GHSA-8w86-m9h8-hvqg.json"