CVE-2025-71394: SurrealDB Path Traversal Vulnerability

CVE-2025-71394 Overview

CVE-2025-71394 is a local file read vulnerability in SurrealDB versions prior to 2.2.2. The flaw resides in the DEFINE ANALYZER statement, which accepts arbitrary file paths without validation. Authenticated users with root, namespace, or database level privileges can direct analyzers to read files from the underlying file system. The database then exposes content from two-column tab-separated value files back to the attacker. This weakness is tracked as a Path Traversal issue under CWE-22.

Critical Impact
Authenticated attackers can exfiltrate sensitive files, including configuration data and credentials stored in two-column tab-separated format, from the host running SurrealDB.

Affected Products

SurrealDB versions before 2.2.2
Deployments exposing SurrealDB to authenticated users at root, namespace, or database scope
Multi-tenant SurrealDB instances where database-level credentials are distributed to untrusted parties

Discovery Timeline

2026-07-18 - CVE-2025-71394 published to the National Vulnerability Database (NVD)
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2025-71394

Vulnerability Analysis

SurrealDB's DEFINE ANALYZER statement configures text analysis pipelines for full-text search. The statement supports loading external resources such as dictionaries and mapping tables. In vulnerable releases, the path argument passed to the analyzer definition is not restricted to a safe base directory. An authenticated user can therefore point the analyzer at any file readable by the SurrealDB process.

When the analyzer parses the referenced file, it treats each line as a two-column tab-separated record. The parsed content is then reachable through subsequent analyzer queries. This allows the attacker to observe file contents without shell access to the database host.

Root Cause

The root cause is missing path validation and sandboxing in the analyzer resource loader. SurrealDB trusts the caller-supplied path and reads any file location the database process can access. The design assumes root, namespace, and database roles are fully trusted, which conflicts with typical multi-tenant deployment models.

Attack Vector

Exploitation requires network access to the SurrealDB endpoint and valid credentials with at least database-level privileges. The attacker issues a DEFINE ANALYZER statement that references a target path such as /etc/passwd or a configuration file containing tab-separated key-value pairs. The attacker then queries the analyzer to retrieve the parsed content. Because the parser expects two tab-separated columns, useful exfiltration is limited to files that match this structure, though partial disclosure remains possible for other formats. See the GitHub Security Advisory GHSA-2cvj-g5r5-jrrg and the Vulncheck Advisory on SurrealDB for technical details.

Detection Methods for CVE-2025-71394

Indicators of Compromise

DEFINE ANALYZER statements referencing absolute file system paths outside expected dictionary directories
Analyzer definitions pointing at OS files such as /etc/passwd, /etc/shadow, or application configuration files
Repeated analyzer redefinitions from the same authenticated principal within short time windows
Unexpected file reads by the SurrealDB process against paths unrelated to its data directory

Detection Strategies

Enable SurrealDB query logging and alert on DEFINE ANALYZER statements containing paths outside an allow-listed directory
Correlate database audit logs with host-level file access telemetry to identify unauthorized reads by the SurrealDB service account
Baseline legitimate analyzer definitions and flag deviations in file path arguments

Monitoring Recommendations

Forward SurrealDB logs to a centralized analytics platform and retain them for post-incident review
Monitor process-level file reads by the SurrealDB binary using host-based endpoint telemetry
Alert on privilege use for root, namespace, and database roles outside expected maintenance windows

How to Mitigate CVE-2025-71394

Immediate Actions Required

Upgrade SurrealDB to version 2.2.2 or later
Rotate any credentials, tokens, or secrets stored in files readable by the SurrealDB process
Audit existing analyzer definitions for suspicious file path references and remove any unauthorized entries
Restrict root, namespace, and database privileges to trusted operators only

Patch Information

The issue is resolved in SurrealDB 2.2.2. Refer to the GitHub Security Advisory GHSA-2cvj-g5r5-jrrg for the official fix and release notes.

Workarounds

Run SurrealDB under a dedicated low-privilege user account with access limited to its data directory
Apply mandatory access controls such as AppArmor or SELinux to constrain file reads by the database process
Remove database and namespace privileges from untrusted users until the patched version is deployed
Isolate the SurrealDB host behind network controls that restrict connections to trusted application tiers

bash

# Configuration example: restrict the SurrealDB service user to its data directory
sudo useradd --system --home /var/lib/surrealdb --shell /usr/sbin/nologin surrealdb
sudo chown -R surrealdb:surrealdb /var/lib/surrealdb
sudo chmod 750 /var/lib/surrealdb

# Verify installed version is patched
surreal version   # expect 2.2.2 or later